pfSense 2.6 issues

stephenw10

You see any errors? If you can't access it but disabling the firewall completely allows it that implies the rules are not loading as expected.

Steve

Jaltus

@stephenw10
hello,
no errors, and no response. seems request are just drop
when firewall is off, I can see all rules.
Which process load rules is there a log of this ?

stephenw10

At the console try manually loading the rules with:

pfctl -f /tmp/rules.debug

Any errors will be shown.

Do you see your own traffic blocked in the firewall log? What rule was blocking it?

Steve

Jaltus

@stephenw10
Hello,
Thanks for your help.
Rules load with no errors.
Traffic is blocked by default rules.
HA Sync doesn't work, but with primary in 2.5.2 and backup in 2.6.0. perhaps it's normal. I use LAN interface for this not a dedicated one.

I can access WEBGUI, if I define a rule for incoming on LAN int.

Before in 2.5.2, I have just one rule on OPT1 for "admin PC" on OPT1 --> "pfsense IP" on LAN 443
I can access pfsense on his 2 IP (opt1 and LAN)
Now, I can only connect to opt1 IP (same subnet). I also need a rule on LAN interface ("admin PC" on OPT1 --> "pfsense IP" LAN 443) to connect to LAN IP

Is there any change on this with upgrade ?

Best regards

stephenw10

That's expected, config sync will not work between different versions.

There have been no changes to how the rules are applied. If you are connecting from a client on the OPT1 interface you would only need a rule on OPT1 to allow that.

What might have changed is the interface ordering. Perhaps you have a NIC that wasn't supported in 2.5.2 and now is in 2.6.
Make sure your admin client is actually getting an IP in the OPT1 subnet.

Steve

Jaltus

@stephenw10
After upgrade of master, everything is ok.
After review screenshot of number in pfsync node, PF was not well synchronize before upgrade.

Thanks a lot for your help

KpuCko

Hmmm, to be honest I really don't know where to start...

Ok, let's not complain about some missing files, probably this can be ignored safely, but - DEINSTALL script failed, IMO is a problem, because I expect to have some left overs from the last stable version, anyway.

The device rebooted successfully, so I had a hope, unfortunately my hope disappeared almost immediately when I logged to the dashboard, I started getting errors:

When I checked the logs I saw such errors appear over and over again:

/rc.filter_configure_sync: The command '/sbin/pfctl -Of /tmp/rules.limits' returned exit code '1', the output was 'pfctl: DIOCSETSYNCOOKIES'

This made me a bit angry, I really got angry when I noticed that I'm unable to go to the internet anymore. The appliance is able to connect to the Internet, but all of the networks are unable, so this is a problem in the core firewall function.... really sad

Beside that I also noticed that my CPU hardware crypto support simply disappeared:

Then with non working production firewall, I had no choices - I decided to go back to the old version. When I went to update tab and selected the old stable branch, the check said - you are using newer version, so no way back, really?!!

My last option was to try to go upper - 2.7.0-devel but I just wanted to see if the issues about the internet has fixed. Well, not really:

There were error(s) loading the rules: pfctl: pfctl_rules - The line in question reads [0]: @ 2022-03-19 16:11:15

stephenw10

Those errors during the upgrade are expected and not an issue.

Re-installing is the only (supported) way to go back to 2.5.2.

What is in /tmp/rules.limits though?

Steve

KpuCko

@stephenw10 I don't know, and can't check because I already reverted back to 2.5.2

I suppose it is something related to pfBlockerNG but who knows.

I tried to remove the package, but this haven't resolved the issue.

stephenw10

What's in the file 2.5.2 then?

I'm not aware of anything than would have changed there but you might have something obscure set.

Steve

KpuCko

@stephenw10 said in pfSense 2.6 issues:

What's in the file 2.5.2 then?

I'm not aware of anything than would have changed there but you might have something obscure set.

Steve

stephenw10

Did you set that state table size or just have a lot of ram?

KpuCko

@stephenw10 said in pfSense 2.6 issues:

Did you set that state table size or just have a lot of ram?

I have 16g of ram

KpuCko

So guys, how to make it more official?
I mean, look at the big post I have created, I have few issues mentioned in there.

Do I need to file a bug report, or as I'm a free user, someone else has to do that?

stephenw10

Anyone can open a bug report: https://redmine.pfsense.org/

We need clear steps to recreate it though and I don't think we have that yet. I've updated numerous devices from 2.5.2 to 2.6 and never hit this and I don't see and other reports of it. There must be something unusual in your ruleset that it hitting an issue.

Can we see your ruleset? (/tmp/rules.debug)

If not can you generate another ruleset that still hits this?

Are you using any obscure features?

Steve

KpuCko

@stephenw10 I have sent to you the needed information via PM

FirewallProblemsOops

I posted in the Limiter thread, but that thread has taken on a life of its own, and is rightly focused only on the limiter issue.

There seems to be a problem in 2.6 and the 2.7 developmental versions, where I only connect to addresses 50% of the time.

I changed nothing in my configuration from 2.5.2 to 2.6 / 2.7(trying these currently, same problem). Pretty straightforward, NO connection limiters, simple ruleset for the Firewall, using DNS Forwarder to OpenDNS.

My Firewall has the pfB_BinaryDefense and pfB_EmergingThreatsDShield lists ( from https://linuxincluded.com/using-pfblockerng-on-pfsense/ ) but obviously basic sites like duckduckgo.com aren't in there, yet my computers on the 2.6/2.7 PFSense box fail around 50% of the time to such basic commercial websites.

I have the Bogon network rule block, WAN to PFsense block, WAN telnet to Pfsense block rules, and that's pretty much it. LAN side, the anti-lockout rule, and a basic block DNS attempts that aren't to PFsense(and thus forwarded to OpenDNS) rule.

Another 2.5.2 box running with the same config, in the same house, with the same ISP obviously, has no issues at all.

These configs have worked through multiple version of PFSense up until 2.6, and the issue persists in the 2.7 developmental versions.

Thanks, any help would be appreciated.

stephenw10

How does it fail? What error do you see?

Are you able to resolve the sites every time?

Are you able to connect in other ways such as ping them reliably?

Steve

FirewallProblemsOops

@stephenw10 said in pfSense 2.6 issues:

How does it fail? What error do you see?

Are you able to resolve the sites every time?

Are you able to connect in other ways such as ping them reliably?

Steve

Using Firefox browser for example, getting this error message:

"Hmm. We’re having trouble finding that site.

We can’t connect to the server at www.tyrrellscrisps.co.uk.

If that address is correct, here are three other things you can try:

Try again later.
Check your network connection.
If you are connected but behind a firewall, check that Firefox has permission to access the Web. "

When I try again/Reload/Refresh, it works, so the site itself is not down. This happens for any major site seemingly at random.

Also noticeable inside services such as Steam, half the page won't load, etc. while other portions load fine. Reloading resolves it usually.

I do not have any Captive Portal or Limiters active, this isn't even through WiFi via FreeRadius3 account, just ethernet cables connected to the PFsense box. Windows 10 machine, a Mint Linux machine, both have the same issue, around 50% connections fail to major websites, but can be reloaded to connect.

And as I said, the configuration has not changed since 2.5.2, where this was working fine, now 2.6 and whatever the current 2.7 snapshot is, both have the DNS failure/blocking issue.

EDIT I am able to ping most sites, not noticing any failures via PING, except to duckduckgo.com ironically which seems to block ping by default. Disclaimer I did not do an extensive test of pinging 300+ sites or anything, a random 20 or so of major websites responded 4 out of 4 pings.

meluvalli

@mohkhalifa
Hello. I upgraded pfSense from 2.5.2. I have pfSense running in Hyper-V machine. For some reason, now my vhdx (virtual hard disk file) keeps growing non stop.

Is this a known issue or is there a setting that got changed that causes this? I tried installing on a fresh VM and restoring my config, but get same result.

When I setup the machine as fresh install, it starts out at 1.5GB image. I have ran it for 24 hours and now it's 5GB and growing.

This didn't happen with previous versions. Largest my image got was about 3GB.

Any idea what could be causing the change?