Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense Plus and SG-3100

    Scheduled Pinned Locked Moved Official Netgate® Hardware
    152 Posts 31 Posters 45.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      mcury @NokkieF
      last edited by mcury

      @nokkief I saved the xml through the GUI settings:

      @mcury the pfsense config you refer to the one in /conf?

      f195b9bf-941f-48c9-97bc-f573ec3a2065-image.png

      Save the XML, edit it and search for pfblockerng

      You will find a few of these:

      			<config>
      				<aliasname>ADs_Basic</aliasname>
      				<description><![CDATA[ADs Basic - Collection of ADvertisement Domain Feeds.]]></description>
      				<row>
      					<format>auto</format>
      					<state><![CDATA[Enabled]]></state>
      					<url>https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts</url>
      					<header>StevenBlack_ADs</header>
      				</row>
      				<action>unbound</action>
      				<cron>EveryDay</cron>
      				<logging>enabled</logging>
      				<order>default</order>
      				<dow>1</dow>
      			</config>
      			<config>
      				<aliasname>EasyList</aliasname>
      				<description><![CDATA[EasyList Feeds - Utilizing only the domains which are listed to be blocked in full.]]></description>
      				<action>unbound</action>
      				<cron>EveryDay</cron>
      				<dow>1</dow>
      				<sort>sort</sort>
      				<logging>enabled</logging>
      				<order>default</order>
      				<filter_alexa></filter_alexa>
      				<custom></custom>
      				<row>
      					<format>auto</format>
      					<state><![CDATA[Enabled]]></state>
      					<url>https://easylist-downloads.adblockplus.org/easylist_noelemhide.txt</url>
      					<header>EasyList</header>
      				</row>
      				<row>
      					<format>auto</format>
      					<state><![CDATA[Enabled]]></state>
      					<url>https://easylist-downloads.adblockplus.org/easylistportuguese.txt</url>
      					<header>EasyList_Portuguese</header>
      				</row>
      				<row>
      					<format>auto</format>
      					<state><![CDATA[Enabled]]></state>
      					<url>https://easylist.to/easylist/easyprivacy.txt</url>
      					<header>EasyPrivacy</header>
      				</row>
      			</config>
      		</pfblockerngdnsbl>
      

      Remove the pfblockernng package without the `keep settings' option.
      Remove everything related to pfblockerng from the XML file, and then restore the config to the firewall through the GUI, this will clean all the feeds from the config.

      Note: It will take a few minutes to complete, your internet will be down during this period.

      Once the config restore/boot completes, install pfblockerng again, run the wizard, and add a few feeds you like, but don't add too many feeds..

      I reinstalled the pfBlocker. I though I cleaned it out pretty well, but it still picked up the PRI1 list

      PRI1 is OK to have, it's installed during the wizard in 3.0.0_16

      I'm using the following lists: (I added Easylist manually, it isn't there by default).

      2597e2f7-3bc5-44b9-a5a9-c4494ff1948b-image.png

      8ed4508a-cd18-4a30-bfd1-4f2ee560021e-image.png

      e1ad1a84-695e-4998-944d-2eecd7d032b5-image.png

      dead on arrival, nowhere to be found.

      N 1 Reply Last reply Reply Quote 1
      • N
        NokkieF @mcury
        last edited by

        @mcury thanks for the help, i am not seeing the php errors anymore. :)

        N 2 Replies Last reply Reply Quote 1
        • N
          NokkieF @NokkieF
          last edited by

          Can I change the maximum memory consumption for php somewhere? Seems the 3100 has plenty of memory left for some more lists?

          1 Reply Last reply Reply Quote 0
          • N
            NokkieF @NokkieF
            last edited by

            I sadly was wrong, just did not pay well enough attention (and probably was hoping it was fixed). I still see the errors every 15 minutes.

            M 1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Unfortunately this is not directly a memory issue that could be solved like that as I understand it.

              artooroA 1 Reply Last reply Reply Quote 0
              • B
                Biggy823 @NOCling
                last edited by

                @nocling Is Snort fixed in this version?

                bmeeksB 1 Reply Last reply Reply Quote 0
                • M
                  mcury @NokkieF
                  last edited by

                  @nokkief said in pfSense Plus and SG-3100:

                  I sadly was wrong, just did not pay well enough attention (and probably was hoping it was fixed). I still see the errors every 15 minutes.

                  Strange, I'm not getting those here.. More than a week running pfblocker, in several vlans..

                  15 minutes? Do you have a cron set to run every 15 minutes?

                  dead on arrival, nowhere to be found.

                  N 1 Reply Last reply Reply Quote 0
                  • bmeeksB
                    bmeeks @Biggy823
                    last edited by

                    @biggy823 said in pfSense Plus and SG-3100:

                    @nocling Is Snort fixed in this version?

                    No. Snort and Suricata both are still victims of the PHP bug on ARM 32-bit hardware such as the SG-3100.

                    S 1 Reply Last reply Reply Quote 0
                    • N
                      NokkieF @mcury
                      last edited by NokkieF

                      @mcury Not that I am aware of. Where can I see the cronjobs listed for the pfSense? crontab -l shows no cronjobs for root
                      cat of /etc/crontab shows
                      */1 * * * * root /usr/sbin/newsyslog

                      M 1 Reply Last reply Reply Quote 0
                      • M
                        mcury @NokkieF
                        last edited by mcury

                        @nokkief said in pfSense Plus and SG-3100:

                        @mcury Not that I am aware of. Where can I see the cronjobs listed for the pfSense? crontab -l shows no cronjobs for root
                        cat of /etc/crontab shows
                        */1 * * * * root /usr/sbin/newsyslog

                        There is a package in package manager, cron
                        Install cron and check what is running every 15 minutes.. It will show all cron tasks
                        Did you set pfblockerng to update the lists every 15 minutes?

                        dead on arrival, nowhere to be found.

                        N 1 Reply Last reply Reply Quote 0
                        • N
                          NokkieF @mcury
                          last edited by

                          @mcury No, once a day. I will instal cron and see what it does

                          N 1 Reply Last reply Reply Quote 0
                          • N
                            NokkieF @NokkieF
                            last edited by

                            Looks like it's doing this
                            0,15,30,45 * * * * root /etc/rc.filter_configure_sync

                            M 1 Reply Last reply Reply Quote 0
                            • M
                              mcury @NokkieF
                              last edited by

                              @nokkief said in pfSense Plus and SG-3100:

                              Looks like it's doing this
                              0,15,30,45 * * * * root /etc/rc.filter_configure_sync

                              hm.. are you on 21.02 p2, right?
                              Because the problem with filter reload was happening only in 21.02 p1

                              dead on arrival, nowhere to be found.

                              N 1 Reply Last reply Reply Quote 0
                              • N
                                NokkieF @mcury
                                last edited by

                                @mcury Yeah, I am
                                21.02.2-RELEASE (arm)
                                built on Mon Apr 12 07:50:07 EDT 2021
                                FreeBSD 12.2-STABLE

                                The system is on the latest version.
                                Version information updated at Mon Apr 26 9:02:50 CEST 2021

                                M 1 Reply Last reply Reply Quote 0
                                • M
                                  mcury @NokkieF
                                  last edited by mcury

                                  @nokkief said in pfSense Plus and SG-3100:

                                  @mcury Yeah, I am
                                  21.02.2-RELEASE (arm)
                                  built on Mon Apr 12 07:50:07 EDT 2021
                                  FreeBSD 12.2-STABLE

                                  The system is on the latest version.
                                  Version information updated at Mon Apr 26 9:02:50 CEST 2021

                                  hm, it is strange..
                                  now I'm not sure if there is something particular about your setup that is triggering it, or if I'm not triggering it by luck and this bug is waiting to happen here, hidden..

                                  Edit: Did you enable these options in DNS Resolver?

                                  f4fe132e-671a-46f3-8045-a137788964d8-image.png

                                  dead on arrival, nowhere to be found.

                                  N 1 Reply Last reply Reply Quote 0
                                  • N
                                    NokkieF @mcury
                                    last edited by

                                    @mcury No, but I did enable the python module. But with or without is not making a difference.

                                    1 Reply Last reply Reply Quote 0
                                    • S
                                      s0m3f00l @bmeeks
                                      last edited by s0m3f00l

                                      @bmeeks said in pfSense Plus and SG-3100:

                                      PHP bug on ARM 32-bit

                                      Has anyone tried rebuilding php from source for the 3100? I am still stuck on 2.4.5p1 because we use suricata. If I wanted just a router firewall without any NGFW stuff I could have build an openwrt box.

                                      1 Reply Last reply Reply Quote 1
                                      • artooroA
                                        artooro @stephenw10
                                        last edited by

                                        @stephenw10 we've had issues with several SG-3100s upgrading them to pfSense 21.02.2, just working on one right now. I just tried clearing all the files in /var/db/aliastables to ensure that it wasn't a large table causing the issue but after a reboot I am still seeing kernel: pid 404 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped)

                                        The two symptoms I've seen after multiple SG-3100 upgrades is that

                                        1. The default gateway is missing
                                        2. When connecting via console the menu interface doesn't load and it jumps straight to a shell.

                                        Am I correct in there being no workaround at this time for these SG-3100 issues?

                                        artooroA 1 Reply Last reply Reply Quote 0
                                        • artooroA
                                          artooro @artooro
                                          last edited by

                                          I just found that commenting out the following lines from /etc/rc.bootup resolved the php-cgi crash issue and on reboot both the default route and console are working correctly.
                                          I figured it must be OpenVPN because of when the error shows up in system.log.

                                          //echo "Syncing OpenVPN settings...";
                                          //openvpn_resync_all();
                                          //echo "done.\n";
                                          

                                          Still need to determine what about OpenVPN would be triggering this.

                                          N 1 Reply Last reply Reply Quote 0
                                          • N
                                            NokkieF @artooro
                                            last edited by

                                            @artooro Thanks, I will give it a try and see if it 'fixes' the error for me too.

                                            artooroA 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.