So many config changes from WireGuard (and even more from pfBlocker if DNSBL is disabled)

Bob.Dig

I noticed that with every reboot, the WireGuard package will create about 10 config changes alone, although there was no "change" at all. Now if you got a problem and want to find a good config, it will get burdensome.
Also if you select not the right one, then rebooted, 10 more changes will be created and you potentially could loose the right one, if you have to do it another time.

To me it looks like that none of what WireGuard is doing there should be a config change.

stephenw10

Yup: https://redmine.pfsense.org/issues/14333

johnpoz

@stephenw10 do we need another redmine or is there one for pfblocker? It does the same sort of thing.. Is it updating its stuff every X hours really a config change?

I set my backups of configs to 100, and change how often it updates stuff because it can fill up and remove your actual changes quite quickly if your not paying attention..

stephenw10

There are somethings, like pfBlocker, that are excluded from Auto Config Backup for that reason. I think Snort reloads are also excluded.

There are a few related bug tickets but I don't see anything specifically for that locally. If it actually does change the config file though I'm not sure how you would exclude it from a diff. Could just ignore it as a timestamp I guess.

bmeeks

I remember discussion about this quite some time in the past. Maybe several years ???

The write_config() system function was altered to allow some control over how backups happen. Here is a snippet of the current function definition with comments describing the fields:

/****f* config/write_config
 * NAME
 *   write_config - Backup and write the firewall configuration.
 * DESCRIPTION
 *   write_config() handles backing up the current configuration,
 *   applying changes, and regenerating the configuration cache.
 * INPUTS
 *   $desc	- string containing the a description of configuration changes
 *   $backup	- boolean: do not back up current configuration if false.
 *   $write_config_only	- boolean: do not sync or reload anything; just save the configuration if true.
 * RESULT
 *   null
 ******/
/* save the system configuration */
function write_config($desc="Unknown", $backup = true, $write_config_only = false) {

I need to examine all the function calls in my two IDS/IPS packages and see where the extra two arguments for $backup and $write_config_only might can be used to control when a config backup is recorded.

For some minimal tasks such as rule package updates or pfBlockerNG rule list updates, it is probably sufficient to simply log a system log message and not record a config backup unless some really important info was changed in the file.

johnpoz

@bmeeks said in So many config changes from WireGuard:

ot record a config backup unless some really important info was changed in the file.

Exactly - it doing an update of its current configuration list/alias, ie the entries is not a "configuration" change imho.. Now if I modified which lists its pulling from, or altered how often they are updated, sure ok yeah the "config" was altered.

But it going out every X hours to see if new IPs or an ASN or IPs have been added remove to a geo list is not a "config" change.. I am glad its not forcing an auto backup upload if that is the case, haven't looked into doing that.

I don't normally use the config restore feature, etc. but I was really just looking into it for some thread.. And I was like well thats pretty useless all that was listed was pfblocker changes.. So I updated the list to be much longer so I could go back a few days even if filled up with the pfblocker nonsense.

bmeeks

Yeah, I think my IDS/IPS package is recording the status (success or failure) of the last rules update and a timestamp. That is not worthy of a config backup. I used it to display that info on a PHP tab, but it does not warrant a config backup. Probably some other similar things in my two packages as well.

Now, if an admin changes things such as adds a new rule category, force disables or enables some particular rule or rules, or changes a parameter setting, then that is worthy of a full config backup.

I have created an internal tracker for me to address this in the next package update.

I can't speak for pfBlockerNG and other packages, but likely similar scenarios exist where some changes are not worth generating a config backup for.

Bob.Dig

@johnpoz said in So many config changes from WireGuard:

I don't normally use the config restore feature, etc. but I was really just looking into it for some thread.. And I was like well thats pretty useless all that was listed was pfblocker changes.. So I updated the list to be much longer so I could go back a few days even if filled up with the pfblocker nonsense.

That is not the list I was showing or is it? Because mine doesn't contain pfBlockerNG and I let that update itself every hour.

johnpoz

@Bob-Dig option 15 from the menu from console/ssh or config history in the menu..

I haven't touched pfblocker in days, but you can see its taking up a slot in the config history

But its not listed in the ACB

Bob.Dig

@johnpoz said in So many config changes from WireGuard:

@Bob-Dig option 15 from the menu from console/ssh or config history in the menu..

It is not listed there for me either. I only see that problem with WireGuard.

johnpoz

@Bob-Dig I would love to know how to stop it.. If you look at a diff, there isn't any listed other than the description

Are you on + or CE?

I don't have wireguard installed, I have tailscale installed.

Not meaning to hijack your thread, but seems related to me - stuff being added to config history, that really shouldn't be imho.

Bob.Dig

@johnpoz said in So many config changes from WireGuard:

@Bob-Dig I would love to know how to stop it..

I am on plus with this machine.
Do the settings play a role here under DiagnosticsBackup & Restore?

Bob.Dig

@johnpoz said in So many config changes from WireGuard:

I don't have wireguard installed, I have tailscale installed.

Becoming lazy, don't want to open a port?

johnpoz

@Bob-Dig while I have a port open for tailscale - I thought I was reading somewhere recently that someone has tailscale working without opening that port.. tailscale is not my go to vpn solution. I use openvpn for day to day remote access.. Which is way less than it use to be now that just full time work from home ;)

As to the backup/config settings - I don't see anything there that would have an effect on the pfblocker stuff

bmeeks

@johnpoz said in So many config changes from WireGuard:

I would love to know how to stop it.

Currently the only way would be to manually edit the PHP code of the pfBlockerNG GUI and add the additional arguments to calls to the write_config() function that I copied in my earlier post. That would require knowledge of the code paths in the package or some study to figure them out.

stephenw10

Do you actually have DNS-BL enabled?

Maybe: https://redmine.pfsense.org/issues/14409

I do have DNS-BL enabled and don't see config backups for it.

johnpoz

@stephenw10 no I do not actually have dns-bl enabled. I just use pfblocker to create native aliases that I use in my firewall rules.

here is what I am using pfblocker for

Bob.Dig

@johnpoz I use both.

johnpoz

@Bob-Dig I wonder if I just enabled dns-bl, without actually using it would get rid of the config entries?

Bob.Dig

@johnpoz said in So many config changes from WireGuard:

@Bob-Dig I wonder if I just enabled dns-bl, without actually using it would get rid of the config entries?

Sounds like a plan.