Messages

DNS reset solved the problem.

Found same issue. Will try to reset dns data
https://forum.opnsense.org/index.php?topic=38430.msg188532#msg188532

Code Select Expand


Currently running OPNsense 23.7.12_5 at Fri Feb 23 15:48:27 MSK 2024
Fetching packages-24.1-amd64.tar: ..................................................................................... done
Fetching base-24.1-amd64.txz: ........ done
Fetching kernel-24.1-amd64.txz: ..... done
Extracting packages-24.1-amd64.tar... done
Extracting base-24.1-amd64.txz... done
Extracting kernel-24.1-amd64.txz... done
Please reboot.
>>> Invoking upgrade script 'squid-plugin.php'
Squid web proxy is not active. Not installing replacement plugin.
>>> Invoking upgrade script 'unbound-duckdb.py'
Traceback (most recent call last):
  File "/usr/local/opnsense/site-python/duckdb_helper.py", line 65, in __enter__
    self.connection = duckdb.connect(database=self._path, read_only=self._read_only)
duckdb.IOException: IO Error: Trying to read a database file with version number 39, but we can only read version 51.
The database file was created with DuckDB version v0.6.0 or v0.6.1.

The storage of DuckDB is not yet stable; newer versions of DuckDB cannot read old database files and vice versa.
The storage will be stabilized when version 1.0 releases.

For now, we recommend that you load the database file in a supported version of DuckDB, and use the EXPORT DATABASE command followed by IMPORT DATABASE on the current version of DuckDB.

See the storage page for more information: https://duckdb.org/internals/storage

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/etc/rc.syshook.d/upgrade/20-unbound-duckdb.py", line 41, in <module>
    if export_database('/var/unbound/data/unbound.duckdb', '/var/cache/unbound.duckdb', 'unbound', 'unbound'):
  File "/usr/local/opnsense/site-python/duckdb_helper.py", line 147, in export_database
    with DbConnection(source, read_only=True) as db:
  File "/usr/local/opnsense/site-python/duckdb_helper.py", line 75, in __enter__
    raise StorageVersionException(str(e))
duckdb_helper.StorageVersionException: IO Error: Trying to read a database file with version number 39, but we can only read version 51.
The database file was created with DuckDB version v0.6.0 or v0.6.1.

The storage of DuckDB is not yet stable; newer versions of DuckDB cannot read old database files and vice versa.
The storage will be stabilized when version 1.0 releases.

For now, we recommend that you load the database file in a supported version of DuckDB, and use the EXPORT DATABASE command followed by IMPORT DATABASE on the current version of DuckDB.

See the storage page for more information: https://duckdb.org/internals/storage
>>> Error in upgrade script '20-unbound-duckdb.py'
***DONE***


Your diagnostic list looks cut off and it also doesn't by default, sort by memory usage.  You can sort that though.  i.e. unbound is taking most of my memory usage.

I sorted by the RES column, i.e. by memory usage.

shadowsocks-libev is written in C

Shadowsocks is not in the default install, and may have a memory leak. What happens when you restart the process ?

After the restart, the problem has not yet recurred, so I can't check. But do you really think that shadowsocks can create a bunch of python processes?

I used the default installation options. If I'm not mistaken, in this case ufs is selected. After a reboot, 540MB of memory is used and is not growing yet.

Проблема в том, что потенциально можно блокировать как vpn протоколы типы openvpn, wireguard, так и shadowsocks. Если первые два банятся по паттернам самого трафика, то последнее на основании того, что траффик вообще не подходит ни под какие паттерны. По крайней мере в Китае сейчас нормально работает только сокрытие траффика под https, т.е. использование утилит типа cloak.

Для себя сделал такое решение (не завязано на opnsense. т.к. на нем это нормально не настроить).
Сервер на зарубежной площадке: https://github.com/n-r-w/shadow-server

Клиент в локальной сети (выступает в качестве гейтвея для компов, которые надо завернуть на впн): https://github.com/n-r-w/shadow-client

Appeared after updating to version 23.7.4. Traffic is not high, on average 10-30 megabits/s.

OPNsense 23.7.4-amd64
FreeBSD 13.2-RELEASE-p3
OpenSSL 1.1.1v 1 Aug 2023

Intel(R) Celeron(R) N5105 @ 2.00GHz (4 cores, 4 threads)

Memory usage:
89 % ( 14506/16191 MB )

SYSTEM: DIAGNOSTICS: ACTIVITY

Code Select Expand


247 root 20 0 343M 142M wait 1 0:00 0.58% /usr/local/bin/python3 /usr/local/opnsense/service/configd.py console (python3.9){python3.9}
247 root 52 0 343M 142M wait 3 0:00 0.30% /usr/local/bin/python3 /usr/local/opnsense/service/configd.py console (python3.9){python3.9}
247 root 20 0 343M 142M wait 2 0:00 0.26% /usr/local/bin/python3 /usr/local/opnsense/service/configd.py console (python3.9){python3.9}
247 root 52 0 343M 142M wait 0 0:00 0.24% /usr/local/bin/python3 /usr/local/opnsense/service/configd.py console (python3.9){python3.9}
247 root 20 0 343M 142M wait 0 0:00 0.13% /usr/local/bin/python3 /usr/local/opnsense/service/configd.py console (python3.9){python3.9}
247 root 52 0 343M 142M wait 2 0:00 0.13% /usr/local/bin/python3 /usr/local/opnsense/service/configd.py console (python3.9){python3.9}
247 root 52 0 343M 142M wait 2 0:00 0.12% /usr/local/bin/python3 /usr/local/opnsense/service/configd.py console (python3.9){python3.9}
247 root 52 0 343M 142M wait 0 0:00 0.08% /usr/local/bin/python3 /usr/local/opnsense/service/configd.py console (python3.9){python3.9}
247 root 52 0 343M 142M wait 3 0:00 0.07% /usr/local/bin/python3 /usr/local/opnsense/service/configd.py console (python3.9){python3.9}
247 root 52 0 343M 142M accept 0 0:44 0.03% /usr/local/bin/python3 /usr/local/opnsense/service/configd.py console (python3.9){python3.9}


Services:

Code Select Expand


configd System Configuration Daemon
cron Cron
dhcpd DHCPv4 Server
dpinger Gateway monitor watcher
dpinger Gateway monitor (MTS_DHCP)
dpinger Gateway monitor (ROST_DHCP)
login Users and Groups
ntpd Network Time Daemon
pf Packet Filter
routing System routing
shadowsockslocal shadowsockslocal daemon
sysctl System tunables
syslog-ng Syslog-ng Daemon
unbound Unbound DNS
webgui Web GUI


At first glance, all services are working fine, but the update log:

Code Select Expand

***GOT REQUEST TO CHECK FOR UPDATES***
Currently running OPNsense 21.7.8 (amd64/OpenSSL) at Sun Jan 30 18:07:17 MSK 2022
Fetching changelog information, please wait... done
Updating OPNsense repository catalogue...
pkg: https://pkg.opnsense.org/FreeBSD:13:amd64/21.7/latest/meta.txz: Not Found
repository OPNsense has no meta file, using default settings
pkg: https://pkg.opnsense.org/FreeBSD:13:amd64/21.7/latest/packagesite.txz: Not Found
Unable to update repository OPNsense
Error updating repositories!
pkg: Repository OPNsense cannot be opened. 'pkg update' required
Checking integrity... done (0 conflicting)
Your packages are up to date.
***DONE***