core: GeoIP broken after upgrade to 21.7

Important notices

Before you add a new report, we ask you kindly to acknowledge the following:

Describe the bug

I have a GeoIP floating rule blocking non-USA/non-Canada traffic. I noticed that nothing is getting through it since upgrading to 21.7. I removed the rule for now.

1 . Remove the existing GeoIP Alias 2. Updated my maxmind api key 3. Updated and set the maxmind URL to the “GeoLite2 ASN: CSV Format” with my api key in the URI https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-Country-CSV&license_key=hunter2&suffix=zip 4. Click Apply 5. Refresh and see:

  • Last updated: 2021-07-27T00:09:16
  • Total number of ranges: 2422331
  1. Click Aliases tab
  2. Click + (Add)
  3. Name: GeoIP_Allow
  4. Type: GeoIP
  5. IPv4 and IPv6 checked
  6. Click America pulldown
  7. Click Canada
  8. Click United States
  9. Click Save
  10. Click Apply
  11. CPU fan spins up, after about 30 seconds I get an Alias alert: Invalid argument. [GeoIP_Allow]

Software version used and hardware type if relevant, e.g.: OPNsense 21.7-amd64 Intel® Core™ i7-4500U CPU @ 1.80GHz (4 cores)

About this issue

  • Original URL
  • State: closed
  • Created 3 years ago
  • Comments: 54 (35 by maintainers)

Commits related to this issue

Most upvoted comments

And i can confirm, it works (at least on my machines)

Thanks

@TheHellSite try to change Firewall Maximum Table Entries at Firewall: Settings: Advanced no reboot required (sysctl will be set equal to this table-entries value)

i did a few more tests and up to the something like 32k limit it seems fine and then it breaks

it can be related to what @AdSchellevis said at https://github.com/opnsense/core/issues/5127#issuecomment-889998159 (“without bogonsv6 configured you’re default is likely to end up as 65535”). and this is not enough for the import of table longer than 32767 lines with -Treplace. i think https://github.com/opnsense/core/commit/f969d857ad6f59a791c9d1c02ef9d851e5db58fe increases the minimum value to 1m

How about emptying the alias on modification and then iterate through the new/added/modified aliases, basically like i did ?

don’t know what the devs will say, but imho it makes sense to use -Treplace instead of -Tflush -Tadd. on failure we are at least left with the old table content and not an empty one

@kulikov-a I would probably leave it with the pfctl error (cannot allocate memory), since the gui will tell you the numbers anyway (with your other change). but I’ll let you play with it for a while, if there’s something to review, just open a PR