@howaziti Read my 3 posts hee https://forum.netgate.com/post/944383 /Bingo

@alex-ku What do you mean by CSV parts ?

@noplan said in unbound question generate keytag query _ta-4f66: _ta These : [image: 1614586564796-45d46f59-ddc4-4232-851b-0cbb020660e8-image.png] are inoffensive. They show that Unbound is using DNSSEC. (Most of) not all sites are not set up to expose DNSSEC in their domain. For your own domains : if your domain registrat has a plug-and-play version avaible, consider using it. But document yourself first for its advantages and inconveniences. Use https://dnsviz.net/ to check DNSSEC status of a domain.

@nguser6947 I don't know about the Netgate boxes, but that certainly wasn't the case with the community version. A few weeks ago, the computer I was running pfsense on died. When I installed it on the new computer I was able to copy over the config and it worked fine.

Missed this in my initial post but after doing another search I came across this: 1. Temporarily enable IPv6 on your LAN interface and set IPv6 Configuration Type to "Static IPv6", then assign it an IPv6 address ("::1" without quotes works with mask /128). Then Save. 2. Go to Services/DHCPv6 Server & RA/LAN/Router Advertisements then set Router Mode to "Disabled". Then Save. 3. Go back to the LAN interface and set IPv6 Configuration Type back to "None" then Save. Seems to have worked and I can now make changes to the LAN interface.

I was getting "diag.backup.php" file when a backup was generated. It appears this was a temporary issue. I'm now getting the normal file format (.xml) after a reboot.

You also are using public IPs in the P2 and NATing to them? How is it failing? More info needed! Steve

@choggy2840 Should have post in Firewall section to attract the best responses. Using floating rule aliases could simplify your firewall.

My issues were in part related to this I still think something isn't quite right, but will post in the proper forum.

Thanks for the link. Saving the wan settings again was the solution for getting IPv6 working again.

@stephenw10 said in Fresh install: WAN goes down and 502 Bad Gateway: running that as router-on-a-stick with VLANs rather than use a USB NIC if you can. Steve thanks. long story short: it was the usb nic. AX88179 controller is a pita for pfsense

@gwaitsi well, i got to the root of the problem but don't know how to solve. If I set the GW to WAN1 or WAN2, smtp is working. If I set the GW to WAN_GW or VPN_FW it is not working. This is true whether i put the WAN1/2 hard down. So something with using the gateway group is killing my smtp on certain clients. Have no clue on how to solve, everything else seems to work.

Here's my setup. For reference, the Vigor is on it's own interface. Obviously adjust each interface for your own. Vigor 130 Lan -> General Setup 1st IP Address: 192.168.2.1 1st Subnet Mask: 255.255.255.0 DHCP Server: Disabled PFSense What is connected where: vtnet0 - connected to Vigor 130 (vtnet0 is also shown against the WAN assignment for PPPoE). You should still be able to assign vtnet0 (or whatever your PPPoE is assigned to) against another interface to access. vtnet1 - LAN Interfaces -> Assignments: vtnet0: Modem - Static IPv4 - Address 192.168.2.20/24 vtnet1: LAN - Static IPv4 - 10.0.0.1/8 Firewall -> NAT -> Outbound Interface (Modem) Protocol (Any) Source (CIDR Range, eg, 10.0.0.0/8) Destination (192.168.2.1/24) Address (Interface Address) Firewall -> Rules -> LAN Interface (LAN) Protocol (Any) Source (LAN Net) Destination (MODEM Net)

@bcruze Worked fine for me from PuTTY using the shell. pkg upgrade I don't normally use the diag console, but I think it would be fine. I was notified by email from the script in this thread. https://forum.netgate.com/topic/137707/auto-update-check-checks-for-updates-to-base-system-packages-and-sends-email-alerts/3

And magically, both Epson R3000 and WP4530 show as online now, even though I haven't used them. Strange behaviour.

@noplan thank you

@roy360 This grabs the both the ipv4 and ipv6 networks. whois -h whois.radb.net -- '-i origin AS32934' | awk '/^route6*:/ {print $2;}' Not sure what's going on with your rule. I'll mess with this this weekend. Would be nice to have something that periodically updates. Edited 2-27 to add: The web service I want to use (https://api.bgpview.io/asn/asn to look up/prefixes) is 'Service Temporarily Unavailable' so that approach will have to wait for another time. Not a good sign for reliability... I did write a quick script to drop the ipv4 and ipv6 prefixes for all three facebook ASNs using, whois -h whois.radb.net -- '-i origin ASxxxxx' | awk '/^route6*:/ {print $2;}', into /usr/local/www and then created two URL table aliases from those files (I did one for v4 and another for v6). Ran the script from a cron job and that looks to work OK. I'll revisit this sometime in the future.