DIOCADDRULENV Error
-
Hmm, without making any changes?
-
@stephenw10 No changes. Weird..
-
@stephenw10 Error is back again today.
There were error(s) loading the rules: pfctl: DIOCADDRULENV: No error: 0 - The line in question reads [0]: @ 2024-05-29 03:45:11 There were error(s) loading the rules: pfctl: DIOCADDRULENV: No such file or directory - The line in question reads [0]: @ 2024-05-29 03:46:04 There were error(s) loading the rules: pfctl: DIOCADDRULENV: No such file or directory - The line in question reads [0]: @ 2024-05-29 03:46:09
-
Anything else in the logs at that time or just preceding it?
-
@stephenw10 Unfortunately timestamps dont go back that far to see. I do have this recurring error in the routing log:
May 29 10:35:43 miniupnpd 94484 ioctl(dev, DIOCCHANGERULE, ...) PF_CHANGE_ADD_TAIL: File exists May 29 10:35:43 miniupnpd 94484 ioctl(dev, DIOCCHANGERULE, ...) PF_CHANGE_ADD_TAIL: File exists May 29 10:35:43 miniupnpd 94484 ioctl(dev, DIOCCHANGERULE, ...) PF_CHANGE_ADD_TAIL: File exists May 29 10:35:43 miniupnpd 94484 ioctl(dev, DIOCCHANGERULE, ...) PF_CHANGE_ADD_TAIL: File exists May 29 10:35:43 miniupnpd 94484 ioctl(dev, DIOCCHANGERULE, ...) PF_CHANGE_ADD_TAIL: File exists May 29 10:35:43 miniupnpd 94484 ioctl(dev, DIOCCHANGERULE, ...) PF_CHANGE_ADD_TAIL: File exists May 29 10:35:44 miniupnpd 94484 ioctl(dev, DIOCCHANGERULE, ...) PF_CHANGE_ADD_TAIL: File exists
Also notice that snort is turning on by itself (I use suricata) even when the service is stopped. Wondering if that is contributing to this error.
-
@hypnosis4u2nv said in DIOCADDRULENV Error:
May 29 10:35:43 miniupnpd 94484 ioctl(dev, DIOCCHANGERULE, ...) PF_CHANGE_ADD_TAIL: File exists
Are you running the update miniupnpd pkg?
How are you disabling Snort?
Yes, running both Snort and Suricata is not supported. -
@stephenw10 Not sure what miniupnpd pkg I'm running, For now I uninstalled the Snort package.
-
There is an updated miniupnpd pkg available in 24.03. If you run
pkg upgrade
you will see it offered. It addresses this: https://redmine.pfsense.org/issues/15470 -
@hypnosis4u2nv updated. Will follow up to see if this error reappears. Thanks!
-
@stephenw10 Update didnt work.
There were error(s) loading the rules: pfctl: DIOCADDRULENV: No such file or directory - The line in question reads [0]: @ 2024-05-30 12:21:03 There were error(s) loading the rules: pfctl: DIOCADDRULENV: No such file or directory - The line in question reads [0]: @ 2024-05-30 12:21:05 There were error(s) loading the rules: pfctl: DIOCADDRULENV: No such file or directory - The line in question reads [0]: @ 2024-05-30 12:40:07
-
@hypnosis4u2nv said in DIOCADDRULENV Error:
May 29 10:35:44 miniupnpd 94484 ioctl(dev, DIOCCHANGERULE, ...) PF_CHANGE_ADD_TAIL: File exists
But you're not seeing the errors from miniupnpd?:
May 29 10:35:44 miniupnpd 94484 ioctl(dev, DIOCCHANGERULE, ...) PF_CHANGE_ADD_TAIL: File exists
-
@stephenw10 Errors still exist in the miniupnpd
-
Hmm, and those errors occur at the same time I assume?
And still nothing else logged at that time? No even triggering this?
-
@stephenw10 The miniupnpd errors are running constantly although they don't trip error logs, just in the routing logs.
The other DIOCADDRULENV error triggers an error and it seems to fluctuate when it does.
-
@hypnosis4u2nv said in DIOCADDRULENV Error:
The miniupnpd errors are running constantly
Ah, well that's an issue!
Hmm, what does
uname -a
show? I wonder if it's somehow still running an old kernel. -
@stephenw10 FreeBSD pfSense.localdomain 15.0-CURRENT FreeBSD 15.0-CURRENT #0 plus-RELENG_24_03-n256311-e71f834dd81: Fri Apr 19 00:28:14 UTC 2024 root@freebsd:/var/jenkins/workspace/pfSense-Plus-snapshots-24_03-main/obj/amd64/Y4MAEJ2R/var/jenkins/workspace/pfSense-Plus-snapshots-24_03-main/sources/FreeBSD-src-plus-RELENG_24_03/amd64.amd64/sys/pfSense amd64
-
May 29 10:35:44 miniupnpd 94484 ioctl(dev, DIOCCHANGERULE, ...) PF_CHANGE_ADD_TAIL: File exists
Hi
I don't know if this will help or not
But, judging by the code in the kernel, this error (in fact, this is not even a global error) suggests that some program is trying to add a rule identical to the one that has already been loaded into the kernel .
in this way,in my opinion, this is not a system error, but an application that is trying to make changes to a certain ruleset -
@Konstanti conflict between pfblocker and suricata or my current rules conflicting with either of them?
-
More like a UPnP application in some downstream client trying to open the same port forward repeatedly.
However I would have thought miniupnpd would know that and not try to open it. Some more useful error in that situation seems likely.
-
@stephenw10 anyway to troubleshoot this?