core: GeoIP broken after upgrade to 21.7
Important notices
Before you add a new report, we ask you kindly to acknowledge the following:
- I have read the contributing guide lines at https://github.com/opnsense/core/blob/master/CONTRIBUTING.md
- I am convinced that my issue is new after having checked both open and closed issues at https://github.com/opnsense/core/issues?q=is%3Aissue
Describe the bug
I have a GeoIP floating rule blocking non-USA/non-Canada traffic. I noticed that nothing is getting through it since upgrading to 21.7. I removed the rule for now.
1 . Remove the existing GeoIP Alias
2. Updated my maxmind api key
3. Updated and set the maxmind URL to the “GeoLite2 ASN: CSV Format” with my api key in the URI https://download.maxmind.com/app/geoip_download?edition_id=GeoLite2-Country-CSV&license_key=hunter2&suffix=zip
4. Click Apply
5. Refresh and see:
Last updated: 2021-07-27T00:09:16
Total number of ranges: 2422331
- Click
Aliases
tab - Click
+
(Add) - Name:
GeoIP_Allow
- Type:
GeoIP
IPv4
andIPv6
checked- Click
America
pulldown - Click
Canada
- Click
United States
- Click
Save
- Click
Apply
- CPU fan spins up, after about 30 seconds I get an Alias alert:
Invalid argument. [GeoIP_Allow]
Software version used and hardware type if relevant, e.g.: OPNsense 21.7-amd64 Intel® Core™ i7-4500U CPU @ 1.80GHz (4 cores)
About this issue
- Original URL
- State: closed
- Created 3 years ago
- Comments: 54 (35 by maintainers)
Commits related to this issue
- Revert "Firewall / Aliases - append most likely cause for pfctl error (Invalid argument isn't very explanatory by itself). closes https://github.com/opnsense/core/issues/5127" This reverts commit 2ea... — committed to opnsense/core by AdSchellevis 3 years ago
- firewall - make sure net.pf.request_maxcount and table-entries are always aligned, related to https://github.com/opnsense/core/issues/5127 as discussed with @fichtner — committed to opnsense/core by AdSchellevis 3 years ago
- firewall - make sure net.pf.request_maxcount and table-entries are always aligned, related to https://github.com/opnsense/core/issues/5127 as discussed with @fichtner (cherry picked from commit f969d... — committed to opnsense/core by AdSchellevis 3 years ago
- firewall - make sure net.pf.request_maxcount and table-entries are always aligned, related to https://github.com/opnsense/core/issues/5127 as discussed with @fichtner (cherry picked from commit f969d... — committed to opnsense/core by AdSchellevis 3 years ago
- Firewall / Aliases - append most likely cause for pfctl error (Invalid argument isn't very explanatory by itself). closes https://github.com/opnsense/core/issues/5127 — committed to opnsense/core by AdSchellevis 3 years ago
- Revert "Firewall / Aliases - append most likely cause for pfctl error (Invalid argument isn't very explanatory by itself). closes https://github.com/opnsense/core/issues/5127" This reverts commit 2ea... — committed to opnsense/core by AdSchellevis 3 years ago
- firewall - make sure net.pf.request_maxcount and table-entries are always aligned, related to https://github.com/opnsense/core/issues/5127 as discussed with @fichtner — committed to opnsense/core by AdSchellevis 3 years ago
- firewall - make sure net.pf.request_maxcount and table-entries are always aligned, related to https://github.com/opnsense/core/issues/5127 as discussed with @fichtner (cherry picked from commit f969d... — committed to DynFi/opnsense-core by AdSchellevis 3 years ago
And i can confirm, it works (at least on my machines)
Thanks
@TheHellSite try to change Firewall Maximum Table Entries at Firewall: Settings: Advanced no reboot required (sysctl will be set equal to this
table-entries
value)it can be related to what @AdSchellevis said at https://github.com/opnsense/core/issues/5127#issuecomment-889998159 (“without bogonsv6 configured you’re default is likely to end up as 65535”). and this is not enough for the import of table longer than 32767 lines with
-Treplace
. i think https://github.com/opnsense/core/commit/f969d857ad6f59a791c9d1c02ef9d851e5db58fe increases the minimum value to 1mdon’t know what the devs will say, but imho it makes sense to use
-Treplace
instead of-Tflush -Tadd
. on failure we are at least left with the old table content and not an empty one@kulikov-a I would probably leave it with the pfctl error (cannot allocate memory), since the gui will tell you the numbers anyway (with your other change). but I’ll let you play with it for a while, if there’s something to review, just open a PR