The pfSense Store

Author Topic: pfBlocker  (Read 182862 times)

0 Members and 1 Guest are viewing this topic.

Offline taryezveb

  • Full Member
  • ***
  • Posts: 104
    • View Profile
Re: pfBlocker
« Reply #285 on: December 30, 2011, 01:11:14 pm »
Needed to restart Squid and the got an alert with the error.

EDIT: Every time Squid is restarted is when the error occurs. I was messing with Squid yesterday, but did not put it together until now.
« Last Edit: December 30, 2011, 01:50:58 pm by taryezveb »

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9961
    • View Profile
Re: pfBlocker
« Reply #286 on: December 30, 2011, 01:57:09 pm »
There was a update on squid package today, apply it and see what happens.

Offline taryezveb

  • Full Member
  • ***
  • Posts: 104
    • View Profile
Re: pfBlocker
« Reply #287 on: December 30, 2011, 02:05:10 pm »
There was a update on squid package today, apply it and see what happens.

Squid was reinstalled with the latest version, but still the same.

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9961
    • View Profile
Re: pfBlocker
« Reply #288 on: December 30, 2011, 02:13:48 pm »
I'll try to reproduce it here.

You get this memory alert once or after squid restart alerts are frequent?

Offline taryezveb

  • Full Member
  • ***
  • Posts: 104
    • View Profile
Re: pfBlocker
« Reply #289 on: December 30, 2011, 02:29:02 pm »
I'll try to reproduce it here.

You get this memory alert once or after squid restart alerts are frequent?

The memory alerts only shows after a Squid restart. After the initial alerts there are no more alerts. At least that is what is occurring here.

Dec 30 15:11:54   php: : There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [19]: table <pfBlockerTBG> persist file "/var/db/aliastables/pfBlockerTBG.txt"

Dec 30 15:11:54   php: : New alert found: There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded The line in question reads [19]: table <pfBlockerTBG> persist file "/var/db/aliastables/pfBlockerTBG.txt"

Dec 30 15:11:46   php: : The command '/sbin/pfctl -o basic -f /tmp/rules.debug' returned exit code '1', the output was '/tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded'

Dec 30 15:11:16   php: : There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded - The line in question reads [19]: table <pfBlockerTBG> persist file "/var/db/aliastables/pfBlockerTBG.txt"

Dec 30 15:11:16   php: : New alert found: There were error(s) loading the rules: /tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded The line in question reads [19]: table <pfBlockerTBG> persist file "/var/db/aliastables/pfBlockerTBG.txt"

Dec 30 15:11:07   php: : The command '/sbin/pfctl -o basic -f /tmp/rules.debug' returned exit code '1', the output was '/tmp/rules.debug:19: cannot define table pfBlockerTBG: Cannot allocate memory pfctl: Syntax error in config file: pf rules not loaded'
Dec 30 15:10:32   php: /pkg_edit.php: Reloading Squid for configuration sync
Dec 30 15:10:32   check_reload_status: Reloading filter
Dec 30 15:10:32   check_reload_status: Syncing firewall
Dec 30 15:10:32   check_reload_status: Reloading filter
Dec 30 15:10:31   php: /pkg_edit.php: Reloading Squid for configuration sync

Offline taryezveb

  • Full Member
  • ***
  • Posts: 104
    • View Profile
Re: pfBlocker
« Reply #290 on: December 30, 2011, 03:24:09 pm »
When that error occurs, Squid fails to work as a transparent proxy. Squid still works if you manually set the proxy settings in a browser for example. I disabled pfBlocker for now. Will try a few things.

Offline LEPM

  • Full Member
  • ***
  • Posts: 178
    • View Profile
Re: pfBlocker
« Reply #291 on: December 30, 2011, 03:31:32 pm »
Increase even more Firewall Maximum Table Entries in system->advanced -> firewall/NAT
      not!!!!      Firewall Maximum States ;)

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9961
    • View Profile
Re: pfBlocker
« Reply #292 on: December 30, 2011, 04:00:55 pm »
PfBlocker use url tables, so it is firewall maximum table entries for sure.

Firewall maximum states are related to active connections. When you reach this value, you can't do anything on firewall.


Offline taryezveb

  • Full Member
  • ***
  • Posts: 104
    • View Profile
Re: pfBlocker
« Reply #293 on: December 30, 2011, 04:04:31 pm »
After trying out a few things all is fine for now. Disabled the TBG List and left the Bluetack enabled. Also in System -> Advanced -> Firewall and NAT; Firewall Maximum Table Entries, removed that large number[9999999999999999] from there. Restarted pfBlocker and now there are no error messages and Squid works as transparent proxy, even with pfBlocker enabled. So it seems the TBG list is the cause of all these issues I was having.

TBG list:

http://list.iblocklist.com/?list=ijfqtofzixtwayqovmxn&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=ecqbsykllnadihkdirsh&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=tbnuqfclfkemqivekikv&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=ewqglwibdgjttwttrinl&fileformat=p2p&archiveformat=gz

Bluetack list:

http://list.iblocklist.com/?list=bt_level1&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_level2&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_level3&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_ads&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_spyware&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_proxy&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_templist&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_hijacked&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_dshield&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=bt_bogon&fileformat=p2p&archiveformat=gz

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9961
    • View Profile
Re: pfBlocker
« Reply #294 on: December 30, 2011, 04:14:40 pm »
You may try if you want add each TBG list until you find what list get errors.

Offline taryezveb

  • Full Member
  • ***
  • Posts: 104
    • View Profile
Re: pfBlocker
« Reply #295 on: December 30, 2011, 04:43:09 pm »
You may try if you want add each TBG list until you find what list get errors.

Yes, I'm going to try that. I might spring for the i-block lists, need to do some research on that. Are the i-block lists any better than the public lists?

Offline taryezveb

  • Full Member
  • ***
  • Posts: 104
    • View Profile
Re: pfBlocker
« Reply #296 on: December 30, 2011, 06:10:34 pm »
Did some testing.

With the following in the TBG list, whenever I try to enable them[one at a time], get the Fatal error below.

http://list.iblocklist.com/?list=ijfqtofzixtwayqovmxn&fileformat=p2p&archiveformat=gz
http://list.iblocklist.com/?list=ecqbsykllnadihkdirsh&fileformat=p2p&archiveformat=gz

Fatal error: Allowed memory size of 134217728 bytes exhausted (tried to allocate 8650655 bytes) in /usr/local/pkg/pfblocker.inc on line 268

Note, the Bluetack list is still enabled. When testing the above.

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9961
    • View Profile
Re: pfBlocker
« Reply #297 on: December 30, 2011, 06:15:03 pm »
the total download exceeds php memory limit.

try to apply one list at time

Offline taryezveb

  • Full Member
  • ***
  • Posts: 104
    • View Profile
Re: pfBlocker
« Reply #298 on: December 30, 2011, 06:21:46 pm »
the total download exceeds php memory limit.

try to apply one list at time
Quote from: taryezveb
whenever I try to enable them[one at a time]
I did, or do you mean something else?

Offline marcelloc

  • Hero Member
  • *****
  • Posts: 9961
    • View Profile
Re: pfBlocker
« Reply #299 on: December 30, 2011, 06:26:35 pm »
I mean that.  Sorry, I didn't saw the "[one at a time]"