Errors loading rules

Phantom_Stage

There were error(s) loading the rules: /tmp/rules.debug:26: cannot define table pfB_Top_v6: Cannot allocate memory - The line in question reads [26]: table <pfB_Top_v6> persist file "/var/db/aliastables/pfB_Top_v6.txt"

Hi all I have been getting several errors when updating with pfBlockerNG_dev does anyone know why and how to resolve this. I have blocked known IPV4-IPV6 outside U.S countries. pretty new at this so any help would be appreciated.

johnpoz

@Phantom_Stage said in Errors loading rules:

Cannot allocate memory

Related to this most likely
https://redmine.pfsense.org/issues/8417

What version of pfsense are you running, the default was changed to 400K vs 200k long time ago..

But you can always adjust it for your own needs on your tables.. I have mine set to 1.6m for example

pfblocker creates tables, just like the bogon tables.. IPv6 is a shit ton of address space ;) So if your trying to build tables that have lots and lots of entries, like with ipv6 then you need to allocate for more entries.

Phantom_Stage

Thanks i made the change will check tomorrow and see if this fixed it...Thanks again

johnpoz

How big did you make it? Let us know how it works out, if not this will figure out what it is.. But 99.999% sure that was your issue.

Are you current on pfsense? 2.4.4p3

Phantom_Stage

Oh gees...running
2.4.4-RELEASE-p3 (amd64)
built on Wed May 15 18:53:44 EDT 2019
FreeBSD 11.2-RELEASE-p10

johnpoz

So it was 400k already I would assume - so how big did you make it? If your doing lots and lots of entries - you might have to up it more, then even my 1.6mil number... All comes down to how many entries your wanting to put into your different tables..

Phantom_Stage

It was set at 400000 made it 4000000. hope that is enough.

Phantom_Stage

hmmm...the error has not reoccurred..how ever now I am getting the following download failed on every attempt.

(pfB_PRI1_v4 - BBC_C2_v4 ] Download FAIL [ 01/09/20 16:01:40)

johnpoz

Well you understand that the geoip now requires a api token, so you have to have an account... If pulling any geoip stuff its going to fail without that info.

Not sure exactly what is all included in what your trying to download there.

Phantom_Stage

I did sign up for my MaxMind account everything else seems to download.

johnpoz

Well I don't use whatever list your using there - but could be a problem with the list, could be a problem with your connection to where that list is located, etc.

What specific list is in - there are a lot of them.. Post a pic of where you set that, and I can try and download it.

edit: is it this?

edit2: if you load it in a browser does it come up

https://osint.bambenekconsulting.com/feeds/c2-ipmasterlist-high.txt

RonpfS

@Phantom_Stage said in Errors loading rules:

(pfB_PRI1_v4 - BBC_C2_v4 ] Download FAIL [ 01/09/20 16:01:40)

This one isn't GeoIP related.

But if all pfBlockerNG boxes around the planet are using default Cron settings, it's possible that some web sites are getting hit hard every hour.

Change Cron Start Hour, Cron Start minutes, even better change Cron hour interval to something bigger.

https://www.reddit.com/r/pfBlockerNG/comments/em3l38/bbc_c2_v4_download_fail/fdo3d1s?utm_source=share&utm_medium=web2x

CF 522 connection timeout. Also another entry that is CF 525 SSL handshake failed.

provels

@Phantom_Stage @johnpoz That's this list.
https://osint.bambenekconsulting.com/feeds/c2-ipmasterlist-high.txt
It's part of the preconfigured feeds, not GeoIP. If you can hit the link, it should work now. Maybe it was offline temporarily.

[ BBC_C2_v4 ]			 Reload [ 01/09/20 17:19:54 ] . completed ..

  Aggregation Stats:
  ------------------
  Original Final      
  ------------------
  214      136        
  ------------------
  ------------------------------
  Original Master     Final     
  ------------------------------
  214      136        136         [ Pass ]

johnpoz

I don't think its default to be on... I do not recall ever going in and turning it OFF... And as you can see it is..

RonpfS

@johnpoz Feeds have evolved over the last year, pfBlockerNG as well.

jdeloach

@johnpoz said in Errors loading rules:

I don't think its default to be on... I do not recall ever going in and turning it OFF... And as you can see it is..

I thought maybe the default that @RonpfS was referring to was the update interval. The default on some of these lists is once per hour. If he left the default at once per hour and several other folks are trying to update once an hour as well, that could cause an overload on the server where the list is located and cause the download to fail. Really the download interval on most all of these lists should be no more often than once per day.

johnpoz

That is true but running the latest version.. And its off on mine.. I really don't use any of those anyway.. I just use the geoip based stuff to be honest. I just use the alias feature..

Phantom_Stage

Sorry been busy with work and home PC upgrade finally back up

Phantom_Stage

Not really sure what you guy's are talking about here kinda like a fresh nu-Bee with this. but I am using the Geo IP and DNSBL. Will look further into logs and see if I can narrow this down.

Here is what I see in the logs as failed.

Previous download failed. Re-attempt download
[ CINS_army_v4 ]
Remote timestamp: Fri, 10 Jan 2020 22:25:07 GMT

Failed to download Feed for md5 comparison! Update skipped
[ CINS_army_v4 ] [ 01/10/20 19:01:02 ]
Remote timestamp: Fri, 10 Jan 2020 23:20:39 GMT

johnpoz

If your having problems downloading lists - you have to check with the list owner.