pfSense Plus and SG-3100
-
There are no lists enabled by default so it must be using lists you have in your config already. What lists do you enabled there?
ON the box I have running it without issues I have it installed mostly for ad-blocking. This is what updating looks like:
UPDATE PROCESS START [ 03/12/21 15:05:39 ] ===[ DNSBL Process ]================================================ [ Easylist_Default ] Reload . completed .. ---------------------------------------------------------------------- Orig. Unique # Dups # White # Alexa Final ---------------------------------------------------------------------- 17258 16569 0 0 0 16569 ---------------------------------------------------------------------- [ Easylist_Privacy ] Reload [ 03/12/21 15:05:40 ] . completed .. Whitelist: amazonaws.com| ---------------------------------------------------------------------- Orig. Unique # Dups # White # Alexa Final ---------------------------------------------------------------------- 4381 4355 59 1 0 4295 ---------------------------------------------------------------------- [ Custom_List_custom ] Reload [ 03/12/21 15:05:41 ]. ---------------------------------------------------------------------- Orig. Unique # Dups # White # Alexa Final ---------------------------------------------------------------------- 7 7 0 0 0 7 ---------------------------------------------------------------------- ------------------------------------------ Assembling database... completed Executing TLD TLD analysis. completed Finalizing TLD... completed ---------------------------------------- Original Matches Removed Final ---------------------------------------- 20871 20748 34 20837 ----------------------------------------- Validating database... completed [ 03/12/21 15:05:47 ] Reloading Unbound.... completed DNSBL update [ 20837 | PASSED ]... completed [ 03/12/21 15:05:49 ] ------------------------------------------ ===[ Continent Process ]============================================ ===[ IPv4 Process ]================================================= [ Spamhaus_drop ] Reload . completed .. [ Google ] Reload . completed .. [ Facebook ] Reload . completed .. [ Netflix ] Reload . completed .. ===[ IPv6 Process ]================================================= ===[ Aliastables / Rules ]========================================== No changes to Firewall rules, skipping Filter Reload Updating: pfB_Spamhaus no changes. Updating: pfB_ASN_List no changes. Archiving Aliastable folder Archiving selected pfBlockerNG files. ===[ FINAL Processing ]===================================== [ Original IP count ] [ 8570 ] ===[ Native List IP Counts ] =================================== 8566 total 7375 /var/db/pfblockerng/native/Google.txt 956 /var/db/pfblockerng/native/Spamhaus_drop.txt 182 /var/db/pfblockerng/native/Facebook.txt 53 /var/db/pfblockerng/native/Netflix.txt ===[ DNSBL Domain/IP Counts ] =================================== 20837 total 16538 /var/db/pfblockerng/dnsbl/Easylist_Default.txt 4293 /var/db/pfblockerng/dnsbl/Easylist_Privacy.txt 6 /var/db/pfblockerng/dnsbl/Custom_List_custom.txt ====================[ Last Updated List Summary ]============== Feb 25 19:01 Spamhaus_drop Feb 27 00:00 Google Feb 27 00:00 Facebook Feb 27 00:00 Netflix IPv4 alias tables IP count ----------------------------- 8566 IPv6 alias tables IP count ----------------------------- 0 Alias table IP Counts ----------------------------- 8566 total 7610 /var/db/aliastables/pfB_ASN_List.txt 956 /var/db/aliastables/pfB_Spamhaus.txt pfSense Table Stats ------------------- table-entries hard limit 1000000 Table Usage Count 11310 UPDATE PROCESS ENDED [ 03/12/21 15:05:57 ]Steve
-
@stephenw10 Tick the option to enable pfblockerng, and update, there are lists by default, you don't need a wizard.
This will create an alias for a firewall rule in LAN with malicious IPs and etc, and that causes the problem during the boot. -
Yes, I did that on another test box that has never had pfBlocker installed and there are no default lists.
UPDATE PROCESS START [ 03/12/21 15:20:15 ] Clearing all DNSBL Feeds... ** DNSBL Disabled ** ===[ Continent Process ]============================================ ===[ Aliastables / Rules ]========================================== No changes to Firewall rules, skipping Filter Reload No Changes to Aliases, Skipping pfctl Update UPDATE PROCESS ENDEDSo if you are seeing lists it's because they already exist on your config and pfBlocker is using them.
What lists do you see?
Steve
-
The PHP dump has been replicated at the command line: https://redmine.pfsense.org/issues/11466#note-21
-
@stephenw10 said in pfSense Plus and SG-3100:
Yes, I did that on another test box that has never had pfBlocker installed and there are no default lists.
UPDATE PROCESS START [ 03/12/21 15:20:15 ] Clearing all DNSBL Feeds... ** DNSBL Disabled ** ===[ Continent Process ]============================================ ===[ Aliastables / Rules ]========================================== No changes to Firewall rules, skipping Filter Reload No Changes to Aliases, Skipping pfctl Update UPDATE PROCESS ENDEDSo if you are seeing lists it's because they already exist on your config and pfBlocker is using them.
What lists do you see?
Steve
If that is the case, the same lists that pfblockerng 3.0.0_15 has, because it was the last pfblockerng version installed.
-
@teamits found another way to trigger it.. not sure if it's the same problem, but try:
ssh to pfsense and type:
gpioctl 2 0 -
@mcury said in pfSense Plus and SG-3100:
gpioctl 2 0
Hmm, interesting. Not the same issue though, php is not involved there:
Mar 14 13:52:52 kernel pid 32606 (gpioctl), jid 0, uid 0: exited on signal 11 (core dumped)Likely that's because the first GPIO device cannot be set like that. You can set a PWM duty there. It should not segfault though.
Steve
-
Any news about this issue?
#11466 latest update on 03/11/21, nobody is assigned to that task..
Searched for this PHP bug in https://bugs.php.net/ and couldn't find anything about this PHP interpreter error for ARM 32 bits and/or Freebsd..
-
Nothing specific yet I'm afraid. We are looking at it though just no-one has been assigned in Redmine. Details will be on the bug report there as we confirm them.
We have a separate internal report we use until we have something useful to add publicly.Steve
-
@stephenw10 Thanks Stephen.
I didn't know about the separate internal report.
-
I can't believe I paid almost $500 for this router lol
-
There is one bug that the affected version is incorrect for the SG-3100 , #11473
-
I continue with version 2.4.5_1 on the SG-3100
I saw that it came out of version 21.02.2, is it stable?I plan to update this week from 2.4.5 to 21.02.2
-
My SG-3100 runs nice with 21.02.2.
-
Same here, didn't try snort/suricata.
Running smoothly with pfblockerng-devel 3.0.0_16 -
@mcury still experiencing same kernel alerts here
-
There was a bug, during the standard upgrade from 2.4.5 to 21.02_2 (the hot fix), where the SG-3100 hung post-install with the triple-flashing-lights.
After connecting a serial console, and verifying no output, I power cycled the SG-3100, and it came back up fine, with the 21.02_2.
I upgraded from 21.02_2 to 21.02.2 (note the _ versus the .) yesterday, and it A) upgraded fine and B) has been running fine with no issues.
Please make sure you take a look at some of the persistent plugin related bugs associated with the 21.x line that are not present in the 2.4.5 code, to make sure you won't be impacted by these bugs, before you upgrade.
Edit: the SG-3100 comes with a serial cable, which you can connect up to a computer and run a serial terminal (like PuTTY or whatever), to watch the upgrade process. I'd recommend doing this, especially from 2.x to 21.x
-
@nokkief Can you share more details about your setup?
I've been testing for about 4 days, trying to crash the SG-3100 with high loads, and it seems to be pretty stable..Are you using suricata/snort ?
Are you using pfblockerng-devel_3.0.0_16, and if so, what feeds? -
@mcury
I am seeing this:2021-04-22 19:30:04.062460+02:00 kernel - pid 73327 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped) 2021-04-22 19:15:03.967524+02:00 kernel - pid 27459 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped) 2021-04-22 19:00:03.889566+02:00 kernel - pid 8141 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped) 2021-04-22 18:45:04.012638+02:00 kernel - pid 56654 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped) 2021-04-22 18:30:03.934697+02:00 kernel - pid 48931 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped) 2021-04-22 18:15:04.057781+02:00 kernel - pid 94150 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped) 2021-04-22 18:02:36.622513+02:00 php 25838 [pfBlockerNG] No changes to Firewall rules, skipping Filter Reload 2021-04-22 18:00:04.180824+02:00 kernel - pid 25987 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped) 2021-04-22 18:00:01.142905+02:00 php 25838 [pfBlockerNG] Starting cron process. 2021-04-22 17:45:04.303922+02:00 kernel - pid 79696 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped) ``` code_textI am running the following packages
acme security 0.6.9_3
haproxy net 0.61_1
pfBlockerNG-devel net 3.0.0_16Not sure how I can easily retrieve the lists I am using, but I am using quite a few.
-
@nokkief Those are the same errors I was getting before.
I'm suspecting that the number of feeds is causing the crash.I would like to suggest you to remove pfblockerng-devel completely and reinstall.
There is an option "keep settings" in pfblocker that you shouldn't tick before package removal.After that, save the pfsense xml configuration, edit it and confirm that there isn't a single entry for pfblockerng...
I'm saying this because the 'old feeds' from previous versions remained in my XML configuration.After removing all the pfblockerng entries in xml, restore it, then reinstall pfblockerng.
I did add dnsbl_easylists feed after the wizard, for me it is enough.
You should add one feed at a time to test..
