pfSense Plus and SG-3100
-
@amarcino I'm in the same situation.
because of things, I think I will stay for a long time in 2.4.5 -
The PHP issue, which is what you will be hitting with pfBlocker and Suricata, seems to be very load dependent.
I have both those running here on SG-3100s in 21.02p1 without any problems. The throughput on the those is not huge and I don't have a large number of lists loaded though.Steve
-
@stephenw10 said in pfSense Plus and SG-3100:
The PHP issue, which is what you will be hitting with pfBlocker and Suricata, seems to be very load dependent.
I have both those running here on SG-3100s in 21.02p1 without any problems. The throughput on the those is not huge and I don't have a large number of lists loaded though.Steve
Hello Steve, if you install pfblockerng, run the wizard, and reboot, you get:
done. Configuring firewall. pflog0: promiscuous mode enabled pid 401 (php-cgi), jid 0, uid 0: exited on signal 11 (core dumped) Segmentation fault (core dumped) Starting CRON... done. Starting package IPsec Profile Wizard...done. Starting package AWS VPC Wizard...done. Starting package acme...done.Nothing works, to recover access, you need, through the console, select the option 11, disable pfblockerng and reboot again.
-
Hmm, interesting. I aleady had it installed before the upgrade. And the wizard is only in the development version which I'm not running on that firewall.
Are you able to install the non-dev version?Steve
-
@stephenw10 said in pfSense Plus and SG-3100:
Hmm, interesting. I aleady had it installed before the upgrade. And the wizard is only in the development version which I'm not running on that firewall.
Are you able to install the non-dev version?Steve
Yes, I can do it right now to confirm, but, as I have been reading everything about this lately, I already found reports from users with the same problem using the non-dev version.
Installed pfblockerng non-dev, enabled it, I'll wait for the update, then reboot, updates soon.
-
It certainly can hit that same issue in the non-dev version if you have a lot of lists loaded triggering the issue when php tries to parse them.
-
@stephenw10 said in pfSense Plus and SG-3100:
It certainly can hit that same issue in the non-dev version if you have a lot of lists loaded triggering the issue when php tries to parse them.
Same lists that I used to have in 2.4.5p1, are failing with 21.02, and 21.02p1.
I usually just run pfblockerng defaults settings to test, and it fails to boot.. -
non-dev version, default settings.
-
Hmm, what are you actually enabling there? The non-dev version doesn't have a wizard to set defaults. I may have disabled some things on my install. I don't use the auto-added firewall rules.
Steve
-
@stephenw10 said in pfSense Plus and SG-3100:
Hmm, what are you actually enabling there? The non-dev version doesn't have a wizard to set defaults. I may have disabled some things on my install. I don't use the auto-added firewall rules.
Steve
Default settings, just install it, wait for the update, or force it, then reboot..
-
By default it is not enabled at all so I assume you enable it?
There are no lists enabled by default either so I assume you added some? Or it pulled in values you already had?
Steve
-
@stephenw10 said in pfSense Plus and SG-3100:
By default it is not enabled at all so I assume you enable it?
There are no lists enabled by default either so I assume you added some? Or it pulled in values you already had?
Steve
Enabled pfblockerng, wait for the update.
There are lists enabled by default, didn't add anything.Just install, enabled it, update it, and reboot, and the bug happens.
Same bug that was happening with 21.02, and this never happened with 2.4.5p1. -
There are no lists enabled by default so it must be using lists you have in your config already. What lists do you enabled there?
ON the box I have running it without issues I have it installed mostly for ad-blocking. This is what updating looks like:
UPDATE PROCESS START [ 03/12/21 15:05:39 ] ===[ DNSBL Process ]================================================ [ Easylist_Default ] Reload . completed .. ---------------------------------------------------------------------- Orig. Unique # Dups # White # Alexa Final ---------------------------------------------------------------------- 17258 16569 0 0 0 16569 ---------------------------------------------------------------------- [ Easylist_Privacy ] Reload [ 03/12/21 15:05:40 ] . completed .. Whitelist: amazonaws.com| ---------------------------------------------------------------------- Orig. Unique # Dups # White # Alexa Final ---------------------------------------------------------------------- 4381 4355 59 1 0 4295 ---------------------------------------------------------------------- [ Custom_List_custom ] Reload [ 03/12/21 15:05:41 ]. ---------------------------------------------------------------------- Orig. Unique # Dups # White # Alexa Final ---------------------------------------------------------------------- 7 7 0 0 0 7 ---------------------------------------------------------------------- ------------------------------------------ Assembling database... completed Executing TLD TLD analysis. completed Finalizing TLD... completed ---------------------------------------- Original Matches Removed Final ---------------------------------------- 20871 20748 34 20837 ----------------------------------------- Validating database... completed [ 03/12/21 15:05:47 ] Reloading Unbound.... completed DNSBL update [ 20837 | PASSED ]... completed [ 03/12/21 15:05:49 ] ------------------------------------------ ===[ Continent Process ]============================================ ===[ IPv4 Process ]================================================= [ Spamhaus_drop ] Reload . completed .. [ Google ] Reload . completed .. [ Facebook ] Reload . completed .. [ Netflix ] Reload . completed .. ===[ IPv6 Process ]================================================= ===[ Aliastables / Rules ]========================================== No changes to Firewall rules, skipping Filter Reload Updating: pfB_Spamhaus no changes. Updating: pfB_ASN_List no changes. Archiving Aliastable folder Archiving selected pfBlockerNG files. ===[ FINAL Processing ]===================================== [ Original IP count ] [ 8570 ] ===[ Native List IP Counts ] =================================== 8566 total 7375 /var/db/pfblockerng/native/Google.txt 956 /var/db/pfblockerng/native/Spamhaus_drop.txt 182 /var/db/pfblockerng/native/Facebook.txt 53 /var/db/pfblockerng/native/Netflix.txt ===[ DNSBL Domain/IP Counts ] =================================== 20837 total 16538 /var/db/pfblockerng/dnsbl/Easylist_Default.txt 4293 /var/db/pfblockerng/dnsbl/Easylist_Privacy.txt 6 /var/db/pfblockerng/dnsbl/Custom_List_custom.txt ====================[ Last Updated List Summary ]============== Feb 25 19:01 Spamhaus_drop Feb 27 00:00 Google Feb 27 00:00 Facebook Feb 27 00:00 Netflix IPv4 alias tables IP count ----------------------------- 8566 IPv6 alias tables IP count ----------------------------- 0 Alias table IP Counts ----------------------------- 8566 total 7610 /var/db/aliastables/pfB_ASN_List.txt 956 /var/db/aliastables/pfB_Spamhaus.txt pfSense Table Stats ------------------- table-entries hard limit 1000000 Table Usage Count 11310 UPDATE PROCESS ENDED [ 03/12/21 15:05:57 ]Steve
-
@stephenw10 Tick the option to enable pfblockerng, and update, there are lists by default, you don't need a wizard.
This will create an alias for a firewall rule in LAN with malicious IPs and etc, and that causes the problem during the boot. -
Yes, I did that on another test box that has never had pfBlocker installed and there are no default lists.
UPDATE PROCESS START [ 03/12/21 15:20:15 ] Clearing all DNSBL Feeds... ** DNSBL Disabled ** ===[ Continent Process ]============================================ ===[ Aliastables / Rules ]========================================== No changes to Firewall rules, skipping Filter Reload No Changes to Aliases, Skipping pfctl Update UPDATE PROCESS ENDEDSo if you are seeing lists it's because they already exist on your config and pfBlocker is using them.
What lists do you see?
Steve
-
The PHP dump has been replicated at the command line: https://redmine.pfsense.org/issues/11466#note-21
-
@stephenw10 said in pfSense Plus and SG-3100:
Yes, I did that on another test box that has never had pfBlocker installed and there are no default lists.
UPDATE PROCESS START [ 03/12/21 15:20:15 ] Clearing all DNSBL Feeds... ** DNSBL Disabled ** ===[ Continent Process ]============================================ ===[ Aliastables / Rules ]========================================== No changes to Firewall rules, skipping Filter Reload No Changes to Aliases, Skipping pfctl Update UPDATE PROCESS ENDEDSo if you are seeing lists it's because they already exist on your config and pfBlocker is using them.
What lists do you see?
Steve
If that is the case, the same lists that pfblockerng 3.0.0_15 has, because it was the last pfblockerng version installed.
-
@teamits found another way to trigger it.. not sure if it's the same problem, but try:
ssh to pfsense and type:
gpioctl 2 0 -
@mcury said in pfSense Plus and SG-3100:
gpioctl 2 0
Hmm, interesting. Not the same issue though, php is not involved there:
Mar 14 13:52:52 kernel pid 32606 (gpioctl), jid 0, uid 0: exited on signal 11 (core dumped)Likely that's because the first GPIO device cannot be set like that. You can set a PWM duty there. It should not segfault though.
Steve
-
Any news about this issue?
#11466 latest update on 03/11/21, nobody is assigned to that task..
Searched for this PHP bug in https://bugs.php.net/ and couldn't find anything about this PHP interpreter error for ARM 32 bits and/or Freebsd..
