pfSense » pfSense Plus

This patch was applied to both pfSense Plus and CE. If you believe there is a regression or the issue is not fully fixed, please provide reproducible steps along with any relevant logs.

Marcos Mendoza wrote:

This patch was applied to both pfSense Plus and CE. If you believe there is a regression or the issue is not fully fixed, please provide reproducible steps along with any relevant logs.

Hello Marcos,

Thanks for looking into this, I believe there is a regression on the code. In order to reproduce this please follow these steps:

1. Create a couple of Instances in EC2 in AWS with the PfSense AMI [[Netgate pfSense Plus Firewall/VPN/Router]] (Master - Slave)
2. In the Slave instance perform the following configurations:
• Create a User Group in Slave instance with the appropriate permissions for xmlrpc synchronization (System - HA node sync).
• Create a User (xmlrpc_user) and assigned it to the newly created User Group above.
• Create an OpenVpn Server (VPN > OpenVPN > Servers) add one and configure as needed (beyond this scope)
• Connect a client machine to this OpenVPN server)

1. Back into the Master instance go to System > High Availability Sync and configure as follows
• Synchronize states = Unchecked
• Synchronize Interface = WAN Interface (or you could create an specific interface for this by attaching a secondary Interface)
• pfsync Synchronize Peer IP = Blank
• Synchronize Config to IP = Slave's WAN Interface's IP Address
• Remote System Username = xmlrpc_user
• Remote System Password = xmlrpc_user's password
• Synchronize admin = checked
• Select options to sync = Select any of these, in my case I just selected Firewall rules
• Make any change to the firewall rule and hit Apply.

1. Last but not least, make any firewall rule change in the Master instance and hit on Apply.
2. Slave PfSense+ Instance will reload the OpenVPN daemon.

At this point, we have disabled the XMLRPC syncronization to avoid affecting production, therefore, no logs are available that can help. But I believe I have something better for you. which are 2 screenshots.

• PfSenseVersion.png demonstrates that we are on the latest version of the PfSense+
• CodeRevision.png illustrates to the left the Code in the PfSense CE repository, while on the right side it shows the xmlrpc.php file in our PfSense+ instance via Shell access.

Things to notice, on the left the function starts with the comment: "do not restart unchanged services on XMLRPC sync", while on the right side function starts with "The DNS Resolver and the DNS Forwarder may both be .."

Please let me know if this helps or if additional information is required.

Thanks.