Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense Community Edition (CE) 2.5.0 and pfSense Plus 21.02 now available!

    Scheduled Pinned Locked Moved
    Messages from the pfSense Team
    49
    115
    53.1k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • E
      elvisimprsntr @bmeeks
      last edited by

      @bmeeks

      I tried to color code the error message in red when I posted the log output, unfortunately I cannot edit my OP.

      I am running Suricata 6.0.0_8

      Hardware is a https://protectli.com/product/fw4a/

      Running pfsense CE

      bmeeksB 1 Reply Last reply Reply Quote 0
      • bmeeksB
        bmeeks @elvisimprsntr
        last edited by

        @elvisimprsntr said in pfSense Community Edition (CE) 2.5.0 and pfSense Plus 21.02 now available!:

        @bmeeks

        I tried to color code the error message in red when I posted the log output, unfortunately I cannot edit my OP.

        I am running Suricata 6.0.0_8

        Hardware is a https://protectli.com/product/fw4a/

        Running pfsense CE

        Oh, okay ... 😀. That one had me wondering for a minute.

        I don't know of any other problems reported like that recently. I will fire up my test VM and check it out to be sure. Many times this is caused by one of the following:

        1. a temporary issue with posting of the actual file (and copying it to all the servers in the CDN network). This would be on the Snort end and will heal itself once the file is replicated around.

        2. a problem accessing the specific Amazon Web Services IP space where the rules file lives. Even though the URL says it's a snort.org site, it actually redirects you to AWS infrastructure. In the past, folks using pfBlockerNG with various IP feeds have sometimes encountered feeds that block some of the IP space of AWS.

        3. a problem with Squid or Squidguard blocking the download if those packages are installed.

        Wait a bit and then retry the rules update manually by going to the UPDATES tab and clicking the button. If it still does not succeed and fails with the same error, then I would first check for anything blocking stuff on your end.

        I will post back with the results of my test shortly.

        E 1 Reply Last reply Reply Quote 0
        • E
          elvisimprsntr @bmeeks
          last edited by

          @bmeeks

          Thanks.

          I disabled pfBLockNG and DNSBL and attempted manual suricata update.
          Unfortunately, I get the same error message

          bmeeksB 1 Reply Last reply Reply Quote 0
          • bmeeksB
            bmeeks @elvisimprsntr
            last edited by

            @elvisimprsntr said in pfSense Community Edition (CE) 2.5.0 and pfSense Plus 21.02 now available!:

            @bmeeks

            Thanks.

            I disabled pfBLockNG and DNSBL and attempted manual suricata update.
            Unfortunately, I get the same error message

            I've duplicated the error in my VM, and the answer is not good. It's not a problem with the Suricata package. Instead, it appears the Snort team has changed the Community Rules to work with only with Snort3 now. The old URL (filename, actually) no longer works, and the new community rules file is named "snort3-community-rules.tar.gz".

            E 1 Reply Last reply Reply Quote 0
            • E
              elvisimprsntr @bmeeks
              last edited by

              @bmeeks

              Thanks for the detective work!

              I guess there is not workaround other than wait for a package update

              bmeeksB 1 Reply Last reply Reply Quote 0
              • bmeeksB
                bmeeks @elvisimprsntr
                last edited by

                @elvisimprsntr said in pfSense Community Edition (CE) 2.5.0 and pfSense Plus 21.02 now available!:

                @bmeeks

                Thanks for the detective work!

                I guess there is not workaround other than wait for a package update

                Well, first I need to check and test if those rules will even work in Snort 2.x. If they have rewritten the rules to use any Snort3-specific syntax, then they won't work in Snort 2.x binaries anymore.

                E 1 Reply Last reply Reply Quote 0
                • C
                  chrcoluk
                  last edited by

                  I have 2 minor issues.

                  1 - igb driver looks like it had a replacement, different sysctl's etc. I noticed its unstable when checksums are off, fixed by turning on (was off from som etesting I did a while ago and forgot to turn back on).
                  2 - For some reason the LAN rule page is slow to load, slow after save, apply also, WAN and other rule pages are fine.

                  Everything else at first glance seems ok.

                  pfSense CE 2.7.2

                  1 Reply Last reply Reply Quote 0
                  • E
                    elvisimprsntr @bmeeks
                    last edited by

                    @bmeeks

                    Just for kicks, I enable use snort custom URL on the on the suricata global settings tab and pasted the v3 community rules URL and performed a manual update.

                    https://www.snort.org/downloads/community/snort3-community-rules.tar.gz

                    The update worked. I can't tell is the rules are actually working.

                    bmeeksB 1 Reply Last reply Reply Quote 0
                    • bmeeksB
                      bmeeks @elvisimprsntr
                      last edited by

                      @elvisimprsntr said in pfSense Community Edition (CE) 2.5.0 and pfSense Plus 21.02 now available!:

                      @bmeeks

                      Just for kicks, I enable use snort custom URL on the on the suricata global settings tab and pasted the v3 community rules URL and performed a manual update.

                      https://www.snort.org/downloads/community/snort3-community-rules.tar.gz

                      The update worked. I can't tell is the rules are actually working.

                      I believe all (or nearly all) of the Community Rules are default disabled out-of-the-box by the creator (Talos). So they are actually not loading. Open up and look at the file and you will see the comment character ("#") in front of each rule. That means it is not processed by the Snort or Suricata engine.

                      To really test compatibility, you would need to remove the comment and enable each rule. I'm researching now to see if these new rules are backwards compatible.

                      Let's take the discussion out of this thread and instead post any further replies and updates to a new thread that has opened in the IDS/IPS sub-forum. This is not an issue with the new pfSense releases. It is an externally-caused problem.

                      1 Reply Last reply Reply Quote 0
                      • R
                        rameshk @elvisimprsntr
                        last edited by

                        @elvisimprsntr
                        I don’t think snort3 rules will work with Suricata. Please extract from my pfSense settings

                        A2BF0C33-544B-4619-8A43-D9ECFF022888.jpeg

                        Hope it helps

                        E 1 Reply Last reply Reply Quote 0
                        • E
                          elvisimprsntr @rameshk
                          last edited by

                          @rameshk

                          I disable use custom URL and performed a manual update.

                          seems to have download the v2 rules now.

                          1 Reply Last reply Reply Quote 1
                          • bmeeksB
                            bmeeks
                            last edited by

                            This issue is now resolved. It was a problem on the Snort/Talos side. They accidentially omitted the old file. It is restored now and updates will work in both Snort and Suricata.

                            R 1 Reply Last reply Reply Quote 1
                            • R
                              rameshk @bmeeks
                              last edited by

                              @bmeeks
                              Just an hour ago Snort GPLv2 rules wouldn’t update. Now downloaded successfully.

                              1 Reply Last reply Reply Quote 0
                              • C
                                chopsuey172 @brians
                                last edited by

                                @brians I'm seeing the same isssue. anyone have an idea?

                                B 1 Reply Last reply Reply Quote 0
                                • J
                                  jkaukenen
                                  last edited by

                                  I do Clouds and am not involved with pfsense much. But this upgrade has been a single disaster for me bc I lost my Snort in this, the paid one, and thats the only reason I went with Netgate/pfsense in the first place.

                                  I cant rollback because the tarballs for the 2.4.x have disappeared, I cant find them.

                                  So Im writing this product off as loss, wish it was managed with a more foresight instead of becoming the low-yield nuke that it is.

                                  S E 2 Replies Last reply Reply Quote 0
                                  • S
                                    SteveITS Rebel Alliance @jkaukenen
                                    last edited by

                                    @jkaukenen said in pfSense Community Edition (CE) 2.5.0 and pfSense Plus 21.02 now available!:

                                    tarballs for the 2.4.x have disappeared

                                    If you open a ticket with Netgate they'll send you a firmware download. If you downgrade make sure to change the version in System/Upgrades before installing packages.

                                    Totally sympathize. With almost everything I wait a bit after release to see if there are issues.

                                    Pre-2.7.2/23.09: Only install packages for your version, or risk breaking it. Select your branch in System/Update/Update Settings.
                                    When upgrading, allow 10-15 minutes to restart, or more depending on packages and device speed.
                                    Upvote 👍 helpful posts!

                                    J 1 Reply Last reply Reply Quote 0
                                    • E
                                      elvisimprsntr @jkaukenen
                                      last edited by

                                      @jkaukenen

                                      I feel your plight. That's why I keep backups of images.

                                      1 Reply Last reply Reply Quote 0
                                      • J
                                        jkaukenen @SteveITS
                                        last edited by

                                        @teamits thank you. I did open a ticket and I was successful in loading the 2.4.5.1, and got my SNORT back....so I am very happy. thanks -

                                        1 Reply Last reply Reply Quote 0
                                        • B
                                          brians @chopsuey172
                                          last edited by

                                          @chopsuey172
                                          re: ipSEC... look on there and apply those six patches.

                                          https://www.provya.com/blog/pfsense-2-5-0-bugs-and-fixes-after-upgrade/#ipsec-problems-pfsense

                                          1 Reply Last reply Reply Quote 0
                                          • pzangaP
                                            pzanga @gpfsenser
                                            last edited by

                                            @gpfsenser @defunct78

                                            Just had the same issue on my sg-1100 about an hour ago. Didn't have time to retry the update. Has anyone come across any further info about this one? I'm just starting to search through the forums for ideas myself.

                                            Thanks

                                            D 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post