net.pf.request_maxcount value set in loader.conf not respected on latest snapshot
The value of
65535 at boot on the latest 2.5.0 snapshot, despite a higher value being set in loader.conf:
: pkg info -x pfSense-2.5.0 pfSense-2.5.0.a.20200902.0050 pfSense-kernel-pfSense-2.5.0.a.20200902.0050 : sysctl net.pf.request_maxcount net.pf.request_maxcount: 65535 : grep net.pf.request_maxcount /boot/loader.conf net.pf.request_maxcount="2000000"
But the value can be set at runtime:
: sysctl net.pf.request_maxcount=2000000 net.pf.request_maxcount: 65535 -> 2000000 : sysctl net.pf.request_maxcount net.pf.request_maxcount: 2000000
See #10254 for some related history
#3 Updated by Michael Spears about 2 months ago
Reproduced on my firewall running latest dev snapshot. Encountered
There were error(s) loading the rules: /tmp/rules.debug:24: cannot define table bogonsv6: too many elements. - The line in question reads : table <bogonsv6> persist file "/etc/bogonsv6" after upgrading, noticed that /etc/bogonsv6 is currently 113412 lines. added a tunable for net.pf.request_maxcount and set it to 200000
#5 Updated by Ted Quade about 2 months ago
Marcos Mendoza wrote:
I can confirm that running the command fixes the filter reload symptom, though that fix doesn't persist through reboots:
I added the tunable in accordance with Michael Spears prior post on the matter and it persists through reboots. Please note the last line of his item as follows: "added a tunable for net.pf.request_maxcount and set it to 200000" which is what I have done as follows:
"System > Advanced > System Tunables > New" then fill in the blanks and save.
#9 Updated by Jim Pingle about 1 month ago
- % Done changed from 100 to 0
With the fix I checked in, the value is tied to the max table size, as it was before. The value is set at boot time, and updates when the max table size is changed.
The value can also be overridden by a system tunable, provided that the new value is larger than the max table size. If a tunable change is not reflected, it's likely because it was set too small.
It should be in snapshots later today/tomorrow.