Cannot define table bogons



  • Hi.
    I installed pfSense 2.2.1 on a KVM virtual machine, and I configured the LAN and WAN networks.
    After the first setup I get a lot of this errors in the pfSense console:

    
    /tmp/rules.debug:17: cannot define table bogons: Invalid argument
    
    

    And no routing/firewall features are working.

    If I try to manually load rules I get the same error:

    
    [2.2.1-RELEASE][root@pfSense.localdomain]/tmp: pfctl -o basic -f /tmp/rules.debug
    /tmp/rules.debug:17: cannot define table bogons: Invalid argument
    pfctl: Syntax error in config file: pf rules not loaded
    
    

    I'm using a raw virtio device and the virtual machine has 2 cores and 16Gb of RAM.
    I'm using virtio network interfaces and the qemu64 type processor.

    I also tried to reinstall the virtual machine from scratch without solving the problem.

    Could you help me please?

    Thank you very much!
    Bye


  • Banned

    Try

    
    /etc/rc.update_bogons.sh 0
    
    

    and see if it helps.


  • Rebel Alliance Global Moderator

    if you go to diag, tables - and pick the bogons table do you have any entries in it?  Do you see a download button there?  If you do and you click on it what happens, for example I just updated mine.  But hmm where did the bogonsv6 go?

    edit:  Hmmm, strange I am currently not blocking bogons - but there is table listing for bogons, but not bogons6.  If I enable bogon blocking, then bogonsv6 shows up in the diag, tables

    And if I look the file is there and shows it was updated when I click download on the bogons table

    [2.2.1-RELEASE][root@pfSense.local.lan]/etc: ls -la bogons*
    -rw-r–r--  1 root  wheel  57714 Mar 19 07:40 bogons
    -rw-r--r--  1 root  wheel  902793 Mar 19 07:40 bogonsv6

    If I go on the wan interface and uncheck block bogons, then the bogonsv6 table is not listed in the diag, tables menu. Hmmm?



  • Banned

    bogonsv6 is skipped altogether if you don't have high-enough limit of tables (System -> Advanced -> Firewall /NAT -> Firewall Maximum Table Entries)



  • If I go to diagnostic - tables I don't' have any entry in the Table dropdown menu.
    I tried to update bogons table from the shell but the script does not exit even after hours, it seems to be hanged.


  • Banned

    If you cannot download the files, it won't work. Can you download this?

    https://files.pfsense.org/lists/fullbogons-ipv4.txt
    https://files.pfsense.org/lists/fullbogons-ipv6.txt


  • Rebel Alliance Global Moderator

    "I don't' have any entry in the Table dropdown menu."

    Well that is an issue more than just bogons then.  What version of pfsense did you install exactly?

    So I have this for that setting, just blank so it should be 200000 right

    Maximum number of table entries for systems such as aliases, sshlockout, snort, etc, combined.
    Note: Leave this blank for the default. On your system the default size is: 200000

    So bogons has like 3633 entries, and if I enable block bogons then the bogonsv6 table shows up in the drop down, which has like 57k entries so why would it be skipped?


  • Banned

    Read the /etc/rc.update_bogons.sh for when it's skipped.


  • Rebel Alliance Global Moderator

    Ok in the logs I get this

    Mar 20 06:04:15 root: rc.update_bogons.sh is ending the update cycle.
    Mar 20 06:04:14 root: Bogons V6 file downloaded but not updating IPv6 bogons table because IPv6 Allow is off

    But clearly that is not the case..

    C:>ping ipv6.google.com

    Pinging ipv6.l.google.com [2607:f8b0:4009:809::200e] with 32 bytes of data:
    Reply from 2607:f8b0:4009:809::200e: time=10ms
    Reply from 2607:f8b0:4009:809::200e: time=12ms

    I actually have multiple ipv6 segments all working fine.. And clearly its being allowed and marked in the advanced section as such



  • Banned

    Dunno, you really need to read the script and test why it fails for you. As you have already noted:

    @johnpoz:

    edit:  Hmmm, strange I am currently not blocking bogons - but there is table listing for bogons, but not bogons6.  If I enable bogon blocking, then bogonsv6 shows up in the diag, tables

    When you don't have the blocking enabled, then the table does not exist, then you get the message because

    
    if [ $BOGONS_V6_TABLE_COUNT -gt 0 ]
    
    

    is false. Overall, messing with this when bogons not used anywhere on your box does not really make much sense. (And yeah the message logged is BS.)


  • Rebel Alliance Global Moderator

    Agree I don't really care, not using bogons - but was curious why it shows the v4 table, but not the v6..  I would expect to not show either of them if not enabled, or show both of them even though they are not actually being used.  The table is clearly there as far as file

    [2.2.1-RELEASE][root@pfSense.local.lan]/etc: ls -la bogons*
    -rw-r–r--  1 root  wheel  57528 Mar 20 06:12 bogons
    -rw-r--r--  1 root  wheel  903765 Mar 20 06:12 bogonsv6

    Why is the table not there?

    [2.2.1-RELEASE][root@pfSense.local.lan]/etc: pfctl -sTables
    LocalsIPv4
    LocalsIPv6
    bogons
    remote
    snort2c
    sshlockout
    tonatsubnets
    virusprot
    webConfiguratorlockout

    I don't think its the update file that creates or doesn't create the table from the get go.  So since the OP has no tables at all, I think that is where he problem is vs the update part of bogons - if there is no tables there at all how could they be updated?

    So the text in the update script needs to be update I think, and if bogons is not enabled there really shouldn't even be a bogons 4 or 6 table.  So why do I have a bogon 4 table?


  • Banned

    @johnpoz:

    So why do I have a bogon 4 table?

    Because there's some basic bogons (v4) file shipped with pfSense core. There's no such thing with IPv6.


  • Rebel Alliance Global Moderator

    So then that again clearly points to the OP problem not being related to the bogon update script if he is not seeing anything in diag tables.

    "If I go to diagnostic - tables I don't' have any entry in the Table dropdown menu."

    So to validate this decibel83 what do you get from

    pfctl -sTables

    Until there is a table there or the other tables I wouldn't look to how it updates as the root of his problem.  Like you said there are core tables shipped.. So he does a clean install and goes to diag, tables he should see those.  Before or even if bogons can or does get updated.



  • this is probably a bug … am getting the same problems on proxmox ... clean install of 2.2.1 ... port forwarding is not working



  • Did anyone every find a solution to this issue?

    I am getting this on 2.2.1 when install on my Proxmox 3.4 machine.
    I am setting HDD/NIC as vitro and CPU as KVM with 2GB ram.

    Does anyone how to make this work with proxmox (2.1.5 doesnt have this issue)



  • @adamBB why are you still using 2.2.1? :o lol anyway this still didn't work on 2.2.2 … am using proxmox 3.4 too ... I went back to 2.1.5 just to have it working

    just in case someone has other ideas ... on how to solve this

    
    [2.2.2-RELEASE][root@pfsense]/root: pfctl -sTables
    bogons
    [2.2.2-RELEASE][root@pfsense]/root: 
    
    

  • Rebel Alliance Global Moderator

    "I went back to 2.1.5 just to have it working"

    For bogons??  Really??  So how many hits a day you getting on blocking bogons?  Blocking bogons while sure ok why not block them, is to be honest pretty useless security measure..  How many hits do you see from bogons - ever even seen a hit?



  • @johnpoz:

    For bogons??  Really??  So how many hits a day you getting on blocking bogons?  Blocking bogons while sure ok why not block them, is to be honest pretty useless security measure..  How many hits do you see from bogons - ever even seen a hit?

    It's not just for bogons mate. As the OP posted:
    1. no routing/firewall features are working
    2. no entries in tables

    
    [2.2.5-RELEASE][root@pfsense]/root: pfctl -sTables
    bogons
    [2.2.5-RELEASE][root@pfsense]/root: 
    
    

    Fresh install of 2.2.5 for Proxmox is still not working. Am using 2.1.5 ATM could be stuck here for a while



  • Hi. I am experiencing the same issue: did you solve it?



  • FYI: in my case the error happens using qemu as hypervisor, and my OpenStack was configured to use it. With KVM it works correctly