Cannot define table bogons

decibel83

Hi.
I installed pfSense 2.2.1 on a KVM virtual machine, and I configured the LAN and WAN networks.
After the first setup I get a lot of this errors in the pfSense console:


/tmp/rules.debug:17: cannot define table bogons: Invalid argument

And no routing/firewall features are working.

If I try to manually load rules I get the same error:


[2.2.1-RELEASE][root@pfSense.localdomain]/tmp: pfctl -o basic -f /tmp/rules.debug
/tmp/rules.debug:17: cannot define table bogons: Invalid argument
pfctl: Syntax error in config file: pf rules not loaded

I'm using a raw virtio device and the virtual machine has 2 cores and 16Gb of RAM.
I'm using virtio network interfaces and the qemu64 type processor.

I also tried to reinstall the virtual machine from scratch without solving the problem.

Could you help me please?

Thank you very much!
Bye

doktornotor

Try


/etc/rc.update_bogons.sh 0

and see if it helps.

johnpoz

if you go to diag, tables - and pick the bogons table do you have any entries in it? Do you see a download button there? If you do and you click on it what happens, for example I just updated mine. But hmm where did the bogonsv6 go?

edit: Hmmm, strange I am currently not blocking bogons - but there is table listing for bogons, but not bogons6. If I enable bogon blocking, then bogonsv6 shows up in the diag, tables

And if I look the file is there and shows it was updated when I click download on the bogons table

[2.2.1-RELEASE][root@pfSense.local.lan]/etc: ls -la bogons*
-rw-r–r-- 1 root wheel 57714 Mar 19 07:40 bogons
-rw-r--r-- 1 root wheel 902793 Mar 19 07:40 bogonsv6

If I go on the wan interface and uncheck block bogons, then the bogonsv6 table is not listed in the diag, tables menu. Hmmm?

bogons.png_thumb

doktornotor

bogonsv6 is skipped altogether if you don't have high-enough limit of tables (System -> Advanced -> Firewall /NAT -> Firewall Maximum Table Entries)

decibel83

If I go to diagnostic - tables I don't' have any entry in the Table dropdown menu.
I tried to update bogons table from the shell but the script does not exit even after hours, it seems to be hanged.

doktornotor

If you cannot download the files, it won't work. Can you download this?

https://files.pfsense.org/lists/fullbogons-ipv4.txt
https://files.pfsense.org/lists/fullbogons-ipv6.txt

johnpoz

"I don't' have any entry in the Table dropdown menu."

Well that is an issue more than just bogons then. What version of pfsense did you install exactly?

So I have this for that setting, just blank so it should be 200000 right

Maximum number of table entries for systems such as aliases, sshlockout, snort, etc, combined.
Note: Leave this blank for the default. On your system the default size is: 200000

So bogons has like 3633 entries, and if I enable block bogons then the bogonsv6 table shows up in the drop down, which has like 57k entries so why would it be skipped?

doktornotor

Read the /etc/rc.update_bogons.sh for when it's skipped.

johnpoz

Ok in the logs I get this

Mar 20 06:04:15 root: rc.update_bogons.sh is ending the update cycle.
Mar 20 06:04:14 root: Bogons V6 file downloaded but not updating IPv6 bogons table because IPv6 Allow is off

But clearly that is not the case..

C:>ping ipv6.google.com

Pinging ipv6.l.google.com [2607:f8b0:4009:809::200e] with 32 bytes of data:
Reply from 2607:f8b0:4009:809::200e: time=10ms
Reply from 2607:f8b0:4009:809::200e: time=12ms

I actually have multiple ipv6 segments all working fine.. And clearly its being allowed and marked in the advanced section as such

allowipv6.png_thumb

doktornotor

Dunno, you really need to read the script and test why it fails for you. As you have already noted:

@johnpoz:

edit: Hmmm, strange I am currently not blocking bogons - but there is table listing for bogons, but not bogons6. If I enable bogon blocking, then bogonsv6 shows up in the diag, tables

When you don't have the blocking enabled, then the table does not exist, then you get the message because


if [ $BOGONS_V6_TABLE_COUNT -gt 0 ]

is false. Overall, messing with this when bogons not used anywhere on your box does not really make much sense. (And yeah the message logged is BS.)

johnpoz

Agree I don't really care, not using bogons - but was curious why it shows the v4 table, but not the v6.. I would expect to not show either of them if not enabled, or show both of them even though they are not actually being used. The table is clearly there as far as file

[2.2.1-RELEASE][root@pfSense.local.lan]/etc: ls -la bogons*
-rw-r–r-- 1 root wheel 57528 Mar 20 06:12 bogons
-rw-r--r-- 1 root wheel 903765 Mar 20 06:12 bogonsv6

Why is the table not there?

[2.2.1-RELEASE][root@pfSense.local.lan]/etc: pfctl -sTables
LocalsIPv4
LocalsIPv6
bogons
remote
snort2c
sshlockout
tonatsubnets
virusprot
webConfiguratorlockout

I don't think its the update file that creates or doesn't create the table from the get go. So since the OP has no tables at all, I think that is where he problem is vs the update part of bogons - if there is no tables there at all how could they be updated?

So the text in the update script needs to be update I think, and if bogons is not enabled there really shouldn't even be a bogons 4 or 6 table. So why do I have a bogon 4 table?

doktornotor

@johnpoz:

So why do I have a bogon 4 table?

Because there's some basic bogons (v4) file shipped with pfSense core. There's no such thing with IPv6.

johnpoz

So then that again clearly points to the OP problem not being related to the bogon update script if he is not seeing anything in diag tables.

"If I go to diagnostic - tables I don't' have any entry in the Table dropdown menu."

So to validate this decibel83 what do you get from

pfctl -sTables

Until there is a table there or the other tables I wouldn't look to how it updates as the root of his problem. Like you said there are core tables shipped.. So he does a clean install and goes to diag, tables he should see those. Before or even if bogons can or does get updated.

guterkerl

this is probably a bug … am getting the same problems on proxmox ... clean install of 2.2.1 ... port forwarding is not working

adamBB

Did anyone every find a solution to this issue?

I am getting this on 2.2.1 when install on my Proxmox 3.4 machine.
I am setting HDD/NIC as vitro and CPU as KVM with 2GB ram.

Does anyone how to make this work with proxmox (2.1.5 doesnt have this issue)

guterkerl

@adamBB why are you still using 2.2.1? :o lol anyway this still didn't work on 2.2.2 … am using proxmox 3.4 too ... I went back to 2.1.5 just to have it working

just in case someone has other ideas ... on how to solve this


[2.2.2-RELEASE][root@pfsense]/root: pfctl -sTables
bogons
[2.2.2-RELEASE][root@pfsense]/root:

johnpoz

"I went back to 2.1.5 just to have it working"

For bogons?? Really?? So how many hits a day you getting on blocking bogons? Blocking bogons while sure ok why not block them, is to be honest pretty useless security measure.. How many hits do you see from bogons - ever even seen a hit?

guterkerl

@johnpoz:

For bogons?? Really?? So how many hits a day you getting on blocking bogons? Blocking bogons while sure ok why not block them, is to be honest pretty useless security measure.. How many hits do you see from bogons - ever even seen a hit?

It's not just for bogons mate. As the OP posted:
1. no routing/firewall features are working
2. no entries in tables


[2.2.5-RELEASE][root@pfsense]/root: pfctl -sTables
bogons
[2.2.5-RELEASE][root@pfsense]/root:

Fresh install of 2.2.5 for Proxmox is still not working. Am using 2.1.5 ATM could be stuck here for a while

d.carmignani

Hi. I am experiencing the same issue: did you solve it?

d.carmignani

FYI: in my case the error happens using qemu as hypervisor, and my OpenStack was configured to use it. With KVM it works correctly