1GB ram is the minimum you need. With that you will not be able to use IPS or DNS Firewall. Make sure both of those are disabled.
It might be that the IP Blocklist downloads any updated list to a temp location first and if the download is successful then it will replace the existing file so it might be that you need more ram than you think during the download and checking phase.
To confirm that I would need to check the code but i don’t have time to do that right now.
Will see if i can check that tomorrow morning.
I checked the code and the update is done in memory.
Each blocklist is checked before downloading to see if it has been updated. If yes then the list is downloaded into a perl variable and checked that the download was successful before moving to the next step.
The next step is that the downloaded list is then parsed and the output placed into the ip set compatible file which is then updated in the firewall rules.
as the ip list is downloaded into a variable then it is in memory until it has been implemented into the firewall rules or ignored if the download was unsuccessful.
So the update will use some extra memory but I don’t know how much.
This is something that will have occurred during a reboot. The firmware loading had a failure.
If this has just happened once and does not repeat when doing a reboot again, then some hiccup happened during the boot that prevented the firmware from loading.
This post seems to address the issue and MAY solve it, but I won’t be trying it anytime soon. I am posting it in case someone has the same problem. Thanks for your help.
The developers recommend at least 1GB. If various built-in/add-on features are used, the amount of memory required will be much higher. Memory consuming features/add-ons are the web proxy and URL filter as well as the Intrusion Detection/Prevention System and the DNS Firewall. Using all of these could consume closer to 5GB or 6GB depending on the number of categories that are selected in each feature.
Another ( temporarily ) memory consuming function is the upgrading process. Download / decrypt are done in memory.
An IPFire where all the available functions are used would therefore be better with 8GB of memory.
None of the errors listed are to do with your memory.
As it says the code had an error trying to download the list.
The code will try to download the list 5 times and if those 5 all failed then you will get that message.
Either there was a problem with internet access, or the route to the list server had an issue or there was some problem with the dns resolving of the fqdn for the list server.
FEODO_RECOMMENDED checks the status every 5 mins so 3 failures in a 24 hour period is not bade.
DSHIELD and TOR_ALL check every hour. So 3 and 4 failures respectively in 24 hours is not a bad result.
You can check when those lists were actually updated by looking in /var/ipfire/ipblocklist/modified. That file has the Epoch time for the last modification update.
You can convert that Epoch time into your normal time via a convertor such as
With the services you have got listed then you will probably be okay with that amount of memory. I have a system with 2GiB of memory and it is running at around 13% of memory without IPS or DNS Firewall enabled.
On that system if I turn on IPS then I know that after a while I will use all the remaining memory up and the system will start triggering the OOM (Out Of Memory) killer to kill some running programs. That was a message you showed in your first post. So with only 1GiB of memory don’t try and enable IPS and DNS Firewall.
1 GiB is the minimum you need to run the basic functions of IPFire. Enabling additional functions without increasing the memory on your system will increase the likelihood of using all the memory up and the system having to run the OOM which will likely stop something running correctly.
No, this are just the DHCP messages for the unbound-dhcp-leases-client. dhcpd signals (name, IP) relation to the DNS resolver unbound.
Blocklists are part of iptables or RPZ lists for the DNS firewall ( part of unbound ).
