@stephenw10 I added a 4 NIC Card into the NAS. Default Install and then set MTU to 1462. Now getting
Jan 22 08:27:00 php-cgi 21877 servicewatchdog_cron.php: Service Watchdog detected service kea-dhcp4 stopped. Restarting kea-dhcp4 (Kea DHCP Server)
Jan 22 08:27:15 php-cgi 95738 notify_monitor.php: Message sent to pranesh@pal.id.au OK
Jan 22 08:28:00 php-cgi 64510 servicewatchdog_cron.php: Service Watchdog detected service unbound stopped. Restarting unbound (DNS Resolver)
Jan 22 08:28:00 php-cgi 64510 servicewatchdog_cron.php: Service Watchdog detected service kea-dhcp4 stopped. Restarting kea-dhcp4 (Kea DHCP Server)
Jan 22 08:28:20 php-cgi 95738 notify_monitor.php: Message sent to pranesh@pal.id.au OK
Jan 22 08:29:00 php-cgi 42905 servicewatchdog_cron.php: Service Watchdog detected service unbound stopped. Restarting unbound (DNS Resolver)
Jan 22 08:29:00 php-cgi 42905 servicewatchdog_cron.php: Service Watchdog detected service kea-dhcp4 stopped. Restarting kea-dhcp4 (Kea DHCP Server)
every minute filling my Inbox. Any thoughts?

@s3b0

In that case, when you see this :

@s3b0 said in Block xxx rated pages redirections (CNAME -> A) - pfblockerng:

;; communications error to 192.168.2.1#53: timed out
;; communications error to 192.168.2.1#53: timed out

which says : dig wanted to contact "192.168.2.1" (== pfSense unbound) but wasn't avaible, so ok ... more DNS servers are available (not there by default, but you've added them), so it took 208.68.222.222 or 208.67.220.220 etc.
And the DNS request against one of them worked out just fine, p#rn.com was resolved.

Exactly what you told your pfSense :

76101dd9-632b-4c55-9b8a-700076e48005-image.png

I guess you get it by now : if you want your DNS request to be filtered by pfBockerng, they have to be handled by unbound (only) who passes them through pfBlockerng. If this circuit can get bypassed, filtering stops working.

I think I may have fixed it. Rebooted the modem and now the WAN port shows an address. Rebooted the Orbi router and made sure it's in AP mode. The color indicator on the Orbi router is solid purple/magenta, which indicates that it has no Internet connection. However, everything is working.

Thanks for the "move the cable" advice.

Just to add, even with IP set on PSF2 manually, no outbound connectivity. Can anyone give me any direction pls?

-S

@bdeprez so your not running unbound or dnsmasq on unbound at all?

One thing bad about just pointing pfsense to some outside dns is you can't resolve any local resources.. you can't put a fqdn of a local resource in your aliases, you can't resolve ptr of local IPs in your firewall by just clicking the little i

firewall.jpg

@stephenw10 said in Netgate 8200 connection questions:

Nice! Yes I think we have seen reports of those WD 520 series working but not available new any longer AFAIK.

yeah, that's the only issue; I wish I could buy new 😑
I think, I'll buy another pair, to keep as the spare.

Did you move the support screw or use adapters for those?

Just moved the support screws.
d6e918e8-a1b7-40cb-9eda-c79290216ddc-image.png

Was pleased to see that mainboard has the native support of diffrent-length M.2 and Netgate was kind enough to supply the extra screws. 😇

Is the layer3 switch routing between those VLANs? If is that could create asymmetric traffic in pfSense.

But run pcaps in pfSense so you can whats actually going through both the interfaces. The earlier pcap show the server sends the Key Exchange Init packet but the client never receives it. So does that arrive at pfSense at all?

@Wylbur said in How do I figure out what part of SNORT is causing a data xfer to fail?:

Meanwhile, I had not realized that this alert area was available. Apparently with the upgrade to 2.7.2?

Uhh ... no. The ALERTS tab has been present in the package since the package was created. Snort has never existed on pfSense without an ALERTS tab being present. That goes back more than 12 years.

There is also a Dashboard Widget that can be enabled for Snort. It shows the most recent 5 or so alerts (the exact count is configurable in the widget).

I'm returning to this thread with an update.

New hardware is in place. The backup - restore - reassign interfaces process was completely flawless and painless.

The new Broadcom-based ports are behaving where the previous hardware's Realtek ports were not.

The problem was solved with $200 in hardware. For those reading after 2025-01-20, the price from China may be higher.

Thanks for the report. The issue may be tracked here:
https://redmine.pfsense.org/issues/16005

@stephenw10 OK will see what I can do thx for help

@patient0
didn't notice that. Thanks!

No, not easily. Potentially, yes, you could replicate it to some external pool. But that's unsupported and unnecessary IMO.

@stephenw10 I'm on the stable branch 2.7.2 up to date. I have now applied all the recommended patches.

A missing unbound key might be expected after hard reboot yes. None of that explains why all the NICs stop passing traffic though. I'm not aware of any issue with igb that would present like that.