Netgate Store

Author Topic: Upgrade 2.4.0: firewall rule with alias and FQDN not working anymore  (Read 2587 times)

0 Members and 1 Guest are viewing this topic.

Offline ggzengel

  • Full Member
  • ***
  • Posts: 264
  • Karma: +3/-0
    • View Profile
Re: Upgrade 2.4.0: firewall rule with alias and FQDN not working anymore
« Reply #30 on: October 17, 2017, 03:26:36 pm »
I restarted my pfsense and got only one filterdns and it's working.
Now I will have a look how long it will be stable.

Offline ChrisCCC

  • Newbie
  • *
  • Posts: 11
  • Karma: +0/-0
    • View Profile
Re: Upgrade 2.4.0: firewall rule with alias and FQDN not working anymore
« Reply #31 on: February 06, 2018, 08:55:20 am »
Hi All,

I know this is an old topic, but I too, have noticed this issue occurring since an upgrade to 2.4.2. This definitely wasn't an issue previously, and very few config changes have been made since the upgrade.

I don't fully understand the process used to build these FQDN aliases, but I'll provide as much info as possible, in the hope it helps narrow down the root cause.

I've created a test Alias, called Host_Test, containing the FQDN 'www.test.com'.

- Viewing the table entry for this alias shows an empty table.

- DNS servers for the firewall are set to 8.8.8.8 and 8.8.4.4. DNS forwarders or resolver are not in use.

- DNS resolution for this hostname is working fine for both DNS servers under status -> DNS Lookup.

- Runninng 'ps -A | grep filterdns' shows there is a process running called filterdns.

- If I view the log under System -> DNS Resolver, I can see that on the date of the upgrade (I assume on first boot after) there are entries such as the below, for all almost all FQDN aliases configured on the firewall. There have since been no events logged in this log.

filterdns      failed to resolve host s186.fmp12-hosting.co.uk will retry later again.

This firewall has an HA partner, which doesn't seem to be experiencing the problem. Based on the total lack of logs since the primary firewall's initial boot, I'm wondering if the root cause is the process hanging (I assume 'filterdns' is the relevant process). Is it possible to safely kill and restart this process, or are there other considerations when doing this?




Offline ChrisCCC

  • Newbie
  • *
  • Posts: 11
  • Karma: +0/-0
    • View Profile
Re: Upgrade 2.4.0: firewall rule with alias and FQDN not working anymore
« Reply #32 on: February 06, 2018, 09:10:23 am »
Quick followup. It looks like the process was hung. It's currently working after running "killall -9 filterdns" then saving and applying an Alias to restart the process.

What's potentially concerning is how soon after bootup this process seems to have stopped responding. Not sure if this is a one off for me, or something peculiar that's happening since the upgrade. I'll update this post if I notice the issue reoccur, especially after the next reboot.

Offline Valeriy

  • Jr. Member
  • **
  • Posts: 52
  • Karma: +7/-0
    • View Profile
Re: Upgrade 2.4.0: firewall rule with alias and FQDN not working anymore
« Reply #33 on: February 08, 2018, 05:34:34 pm »
I can confirm the issue and workaround by ChrisCCC
(Filter DNS service hangs, killall - 9 filterdns and then Filter reload (in pfSense GUI) solves the issue.)


I got the same problem after upgrade to 2.4

Currently running snapshot [2.4.3-DEVELOPMENT (amd64) built on Sun Jan 07 20:44:55 CST 2018]




Things to consider (in no particular order), that might be causing it:

- I have substantial amount of hostname records in different  Firewall aliases (hundreds)

- After a while some hosts become obsolete (i.e. hostname does not resolve to IP address)


- sometimes DNS servers might not be responding quickly (for such a big volume of DNS queries, perhaps)

I guess something is broken in filterdns algorithm after release 2.4: either after incorrect response from DNS server or absense of response causes it to hang.

Offline snarfattack

  • Newbie
  • *
  • Posts: 2
  • Karma: +0/-0
    • View Profile
Re: Upgrade 2.4.0: firewall rule with alias and FQDN not working anymore
« Reply #34 on: February 09, 2018, 07:26:01 am »
Thanks for the workaround... this bug is driving me nuts too. Killing filterdns fixed the issue, at least temporarily for me. After a couple updates, it'll fail again.

Offline Valeriy

  • Jr. Member
  • **
  • Posts: 52
  • Karma: +7/-0
    • View Profile
Re: Upgrade 2.4.0: firewall rule with alias and FQDN not working anymore
« Reply #35 on: February 16, 2018, 02:49:04 pm »
It drove me crazy too, I wish I could have read this thread before I spent a few hours looking what is wrong.

Also,
https://forum.pfsense.org/index.php?topic=141441.15 is same topic.
Maybe Moderators can merge it?

Offline echu2016

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Re: Upgrade 2.4.0: firewall rule with alias and FQDN not working anymore
« Reply #36 on: March 23, 2018, 09:39:50 am »
Does any body having this issue uses pfblocker ? In my case removing this PKG and replacing it by url tables aliases solved the issue.
Filterdns was receiving several sighup signals before, before hanging.

Offline trees spanning the land

  • Newbie
  • *
  • Posts: 3
  • Karma: +0/-0
    • View Profile
Re: Upgrade 2.4.0: firewall rule with alias and FQDN not working anymore
« Reply #37 on: May 05, 2018, 06:10:42 am »

- I have substantial amount of hostname records in different  Firewall aliases (hundreds)


^This seems to be the problem, I had an alias with a list of Hundreds if not thousands of server Host names deleting them and then simply going to the other aliases with empty tables and clicking save to trigger a filter reload and update to the tables for those aliases has fixed the issue.

For everyone having this issue I'd recommend checking your Aliases to see if possibly you or someone else maybe added an alias into the firewall with a very large amount of hostnames and doing a backup of them and trying a delete and re-applying the other affected ones.

If we get some people coming back saying this is the cause then the devs will know what to investigate and hopefully get a fix put out for it.

I'm On 2.4.4-DEVELOPMENT If anyone finds that info Helpful.

Offline qwertyface

  • Newbie
  • *
  • Posts: 1
  • Karma: +0/-0
    • View Profile
Re: Upgrade 2.4.0: firewall rule with alias and FQDN not working anymore
« Reply #38 on: May 17, 2018, 04:46:52 am »
I've just experienced this issue, and I think I have a solution.

For a while (including before the upgrade) I'd been seeing errors saying something like:
Code: [Select]
There were error(s) loading the rules: /tmp/rules.debug:24: cannot define table bogonsv6: Cannot allocate memory - The line in question reads [24]: table <bogonsv6> persist file "/etc/bogonsv6"
@ 2018-05-16 19:13:38

From https://forum.pfsense.org/index.php?topic=145990 I learned that the size of the BogonsV6 file grew substantially recently. The thread suggests increasing maximum table entries. While investigating, I noticed that the tables for my aliases were empty (Diagnostics > Tables). After increasing the maximum table entries, my aliases were showing up in the tables view.

I think this was probably a latent issue before the upgrade, caused by the size of the BogonsV6 table, and it's the reboot which has caused it, not the upgrade.