Zenarmor installation crashes OPNsense. Reboot hangs.

[doug_phoenix]

Hello community,

I'm a new user with OPNsense, running a Protectli VP2420 (J412 Celeron, 16 MB RAM, 500 GB SSD).

Installation of Sensei/Zenarmor crashes my Protectli running OPNsense. It's happened three times now, and each crash is hard (requires reinstalling OPNsense and reconfiguring). I'm running the Protectli as my home router, and the crashes are more than inconvenient (home automation down, lots of reconfiguring).

With the last two attempts I see the following on the OPNsense CLI when the boot proces hangs:
KDB: enter panic
[ thread PID 54 tid 1001106]
Stopped at kdb_enter+0x37: movq $0.0x11f86efe(%rip)
db>

This occurs with boot into "safe mode;" std. boot also hangs. It just takes longer.

Network configuration:
Modem -> Protectli OPNsense WAN -> LAN -> Switch 1 (PC 1 – monitors OPNsense etc., Eero wifi router – double-NAT, two-port LACP to router 2), -> Router 2 (PC2, two port LACP to Switch 1).

I suspected that LACP between my two switches was an issue, so I removed LACP and rebooted OPNsense and tried installing ZenArmor. Same crash and subsequent boot hang. (Note that OPNsense was NOT configured with LACP in any case.)

I'm a bit concerned about the double-NAT with the Eero router, but the darn thing doesn't seem to work in bridge mode in this configuration. Most of my devices are WiFi. 

Are there any Sensei's out there who can help me? I wish to run Zenarmor, and my router is supposed to be up-to-the-task.

Doug_Phoenix

[mb]

Hi @doug_phoenix,

Sorry to hear that. It looks like you're hitting a nasty kernel bug which might be triggered by netmap.

Any chances you can type trace in the ddb prompt and send us the kernel stack trace? That will be a lot more helpful.

[cookiemonster]

Out of interest, why do you have to have eeros in router mode instead of bridge? Is it that only in router mode you can put both NIC ports on them as LACP?

[doug_phoenix]

Hi mb, as I recall, I was unable to type characters at the db prompt. Also, now that I’ve recovered most of my network, I’m reluctant to recreate the crash. Sorry!!

I found a post regarding a patch for the kernel bug, which is why I tested with LACP disabled. I have not tried my OPNsense router with LACP, just my switches. I still need to recover Switch 2.

Hi cookiemonster, I did not wish to leave my eeros in router mode. I tried bridge mode but was unable to connect. Most of my network is WiFi, so it’s inconvenient to be down. I thought about testing with the eeros disconnected, but I’ve had a hard day trying to recover from the LACP test. I wish to learn a bit more before I risk another network-down day.

However, I do wish to try bridge mode again, once all of my network is recovered.

Thank you two very much!!! Let me know if you have any additional comments or insights.

[cookiemonster]

Hey dough_phoenix, I don't need/want link agregation so I have my eeros all in bridge mode. The ones on the OPN network at least. I have two fiber lines into the house and one is using an eero in router mode, standalone line.
The other fiber line has the fiber PON going to OPN as WAN then downstream the LAN cable goes to a managed switch where the main eero in bridge mode sits, the the other eeros also in bridge, connect to it. All works fine.
Maybe we can get you setup that way after you have this niggle ironed out.

[doug_phoenix]

Hi cookiemonster,

Thank you!! I really like my eeros, and I do wish to keep them. Let me settle down things in my network first. I'm considering "downgrading" my router hardware.

The post below indicates there is an issue with the driver for Intel 2.5GHz NICs. My router (Protectli VP2420) has these. I hadn't realized this could be an issue.
https://forum.opnsense.org/index.php?topic=32645.0

If the emulation project mentioned there will take a few weeks, I can wait. But, I don't really need 2.5GHz capability, I bought the hardware for the processor and memory capacity (to run ZenArmor!).  So I may just exchange for different hardware.

I'll be in touch again once I need help with the eeros.

Doug_Phoenix

[doug_phoenix]

Brief update.

I experienced another major crash today, this time configuring Intrusion Detection. I didn't realize that it also relies on Netmap.

I'm returning my Protectli Vault. I may exchange for a lower-spec model (1 GHz Intel NICs).

Thanks all for the great help!

[doug_phoenix]

An update for anyone who is checking.

My previous issues were due to a DRAM/BIOS issue. No wonder I had crashes loading a memory-intensive add-on.

I'm up and running with a VP2410, no issues with the hardware. Protectli addressed my problem very promptly and I'm a happy customer. 

Also, @cookiemonster helped my work through an issue with eeros in bridge mode. Thanks!!

doug_phoenix