There were error(s) loading the rules

choodee

Hi Everyone,

PfSense 2.3.3-RELEASE

I can't seem to figure out where this problem is coming from which started a few months ago. Now and then this error comes up and drops our internet connection for a split second.

There were error(s) loading the rules: /tmp/rules.debug:129: could not parse host specification - The line in question reads [129]: table <time_chu_nrc_ca> { time1.chu.nrc.ca./32 }

I tried adjusting the NTP Server values and looking at the firewall rules without success. Appreciate all those who can point me in the right direction.

Thanks

KOM

Is this something pfBlocker stuffed into the ruleset or is this some rule you made?

choodee

Hi Kom,

I'm using Snort but not pFblocker on the firewall. I looked into my firewall rules and I don't have anything in there that would block time1.chu.nrc.ca./32.

thanks,

KOM

Is there supposed to be a . at the end of the hostname?

time1.chu.nrc.ca./32

versus

time1.chu.nrc.ca/32

What rules do you have that refer to this time server? I use time.nrc.ca for my NTP def but there is nothing in the rules about it.

choodee

That's where I'm having issues. I don't have time1.chu.nrc.ca referenced anywhere in NTP or in firewall rules. I use 1.ca.pool.ntp.org, 0.ca.pool.ntp.org and ca.pool.ntp.org for my time servers so i don't know where this error is coming from.

KOM

Packages like Snort, Suricata and pfBlocker uses rule lists. Maybe something in there?

choodee

i can temporarily turn off Snort and see what happens.

choodee

So I just got the same error a few minutes ago. Looks like snort is not the culprit. Any other thoughts?

KOM

Any other thoughts?

Shell in and look at /tmp/rules.debug. What's line 129 say?

What packages in total are you running? Post a screenshot(s) of your WAN/LAN rules with public details obscured.

choodee

Thanks Kom for your assistance. I was able to find the problem under Firewall - Aliases, there was an entry for time1.chu.nrc.ca that had no IP which was probably used for a previous firewall rule. All is now well.

thanks!