pfSense Crash reported

[denzuko]

Expected Behavior

• Operational Network

Actual Behavior

• Several issues with routing and network stablity

Additional Details

Crash report begins. Anonymous machine information:

amd64 11.1-RELEASE-p4 FreeBSD 11.1-RELEASE-p4 #3 r313908+79c92265a31(RELENG_2_4): Mon Nov 20 09:17:24 CST 2017 root@buildbot2.netgate.com:/xbuilder/crossbuild-242/pfSense/tmp/obj/xbuilder/crossbuild-242/pfSense/tmp/FreeBSD-src/sys/pfSense

Crash report details:

PHP Errors: [26-Nov-2017 15:28:39 America/Chicago] PHP Warning: PHP Startup: Unable to load dynamic library '/usr/local/lib/php/20131226/intl.so' - Shared object "libicui18n.so.59" not found, required by "intl.so" in Unknown on line 0

[27-Nov-2017 19:00:54 America/Chicago] PHP Warning: PHP Startup: Unable to load dynamic library '/usr/local/lib/php/20131226/intl.so' - Shared object "libicui18n.so.59" not found, required by "intl.so" in Unknown on line 0

[denzuko]

Event has been scheduled: https://calendar.dallasmakerspace.org/events/view/4706

[denzuko]

pfSense-pkg-pfBlockerNG upgraded successfully:

installed packages to be UPGRADED: pfSense-pkg-pfBlockerNG: 2.1.2_1 -> 2.1.2_2

[denzuko]

pfSense-pkg-net-snmp installation successfully completed.

[denzuko]

AutoConfigBackup 1.50 upgraded

Complained about i18n php libraries but marked successful installed.

[denzuko]

pfSense-pkg-bind successfully installed.

[denzuko]

RBLs in place:

===[ Deny List IP Counts ]===========================

33904 total 27319 /var/db/pfblockerng/deny/Pedophilia.txt 3122 /var/db/pfblockerng/deny/Adware.txt 2949 /var/db/pfblockerng/deny/Spyware.txt 514 /var/db/pfblockerng/deny/Hijacked.txt

===[ DNSBL Domain/IP Counts ] ===================================

77665 total 39740 /var/db/pfblockerng/dnsbl/PiHole.txt 14950 /var/db/pfblockerng/dnsbl/MalwareDomains.txt 9451 /var/db/pfblockerng/dnsbl/EL.txt 8129 /var/db/pfblockerng/dnsbl/Cameleon.txt 3070 /var/db/pfblockerng/dnsbl/EP.txt 1887 /var/db/pfblockerng/dnsbl/CnC.txt 383 /var/db/pfblockerng/dnsbl/ZeusTracker.txt 38 /var/db/pfblockerng/dnsbl/EL.ip 16 /var/db/pfblockerng/dnsbl/EP.ip 1 /var/db/pfblockerng/dnsbl/PiHole.ip 0 /var/db/pfblockerng/dnsbl/SimpleTracking.fail 0 /var/db/pfblockerng/dnsbl/SimpleAdd.fail 0 /var/db/pfblockerng/dnsbl/MVPS.fail 0 /var/db/pfblockerng/dnsbl/AdServers.fail

====================[ Last Updated List Summary ]==============

Dec 17 14:41 Spyware Dec 17 16:15 Pedophilia Dec 17 20:46 Hijacked Dec 17 23:53 Adware

Database Sanity check [ PASSED ]

[denzuko]

System dns moved from 8.8.8.{8,4} to internal AD/Wins dns servers (0.33 and 10.32) then VLAN9 and VLAN2 dhcp settings updated to drop dns and use pfsence as main dns server

Diagram looks like this:

[dns request from client]->{pfsense} :: rbl allows->is_cached?->(no)->prdcx->is_cached?->(no)->[hit root servers] ----------------- --> (yes) -> return domain

[denzuko]

VL9 -> VL2 and VL2-> VL9 closed off via blocking drain.

Need to create a bridge vlan interface for assignment or prefered a vpn setup that can jump the firewall.

[denzuko]

Doing bandwidth testing found that DMS-L04 was pulling huge amounts of traffic. Most of the time averaging around 500Kb/s but spikes go up to 1.4Mbs.

[denzuko]

Also caught a few 1.xMbs spikes from 3DFab-03 and other 3DFab-0x machines.

[denzuko]

AndrewsiPhone7 was found to hit a 17MB/s

"iPhone" - :cb:3f was also spiking in the MB/s as well.

[denzuko]

Further analysis will be needed to determine the types of traffic causing the spikes.

However the maintenance window has been completed.

The bug above could not be addressed without direct console access which was not available doing window.