@stephenw10 - Thank you Stephen for taking the time to reply. The following is an update for anyone who comes across this which may benefit from this exchange.

No matter what I tried i could not get rid of the crash. I noticed this usually happens when the firewall is under heavy use. Normal use usually did not result with the issue.
In the end I decided to change the machine and now using Intel(R) Core(TM) i5-8500 CPU which has been working with no issues for few days now. I know this is way overkill, but the lower powered ones were problematic.

As for your question on:
Do you see the file /var/etc/xinetd.conf present on the system?

I moved into a different system and don't have access to that install anymore hence i can not answer it.

@stephenw10

Thanks Steve. We will replace this mini-PC with a VM on an Intel NIC platform.

In every other respect the mini-PC has been great but there is nothing to gain with experimenting on this hardware.

Nice result! That was certainly a weird issue. 😉

@Headstorm-0

That intel NIC should be solid, can you test with snort and pfBlockerNG fully disabled to see if this persists? make sure running a force reload>all in pfB returns no output.

@kp206 Go to the gateways logs (Status / System Logs / Gateways) and see what dpinger is reporting when the problem happens, and when you attempt to restart the service.

Assuming that you are not doing multi-wan, two quick questions:

Do you have an explicit monitor address set for the gateway in System -> Routing -> Gateways? Do you have addition of static routes for gateways (System / Advanced / Miscellaneous) enabled or disabled?

@macaruchi

Peers allow Adresses > gust give 1 IP per Peer (/32) + check your Firewall Rules

@ojosaghae

Coming from that far, 2.5.1, I would backup a pfSense config, and not bothering upgrading the device.
Install clean with a memstick version from pfSense download.

You'll have a chance to change the file system to ZFS.
"You want that" and in place upgrading can't give you that.

Probably not. What I would expect to be required would be to bridge each VLAN individually. But if you do that you can't bridge the untagged parent interfaces because it will break VLANs on those NICs.
So if you moved all traffic onto VLANs then using multiple bridges it should.

Steve

If it's a bug in GAProxy it might be fixed in the dev version of the package. It uses 2.8.d12 vs 2.7.8 in the standard pkg.

@mpcjames
Just to help with some of your early questions.

You are correct that the Openreach VLAN is added by the modem or ONT. For generic modems this may have to be added manually, or not, as some UK-specific firmware loads do this for you (eg on some Draytek units with BT-approved firmware).

The MTU for your WAN/pppoe0 link (shown as MRU 1492 in your stats above) should be set at 1500 - ie the standard packet size. The actual physical interface connection between your pfSense router to the Openreach modem or ONT should be set at 1508 MTU, to allow for the extra 8-bytes of the PPPoE wrapper:

2023-09-07 at 11.18.35.png

2023-09-07 at 11.19.14.png

You will see the somewhat bogus PPPoE MTU 1492 mentioned a lot on English-speaking forums as they tend to be dominated by those from the US, where they do things differently. The 1492 setting has become somewhat of an internet lore but is incorrect for many other countries, including the UK.

I'm on the pfSense Plus side of the house where there have also been a number of PPPoE niggles, one of which is the multiple attempts to achieve a PPPoE link, rather than the expected single attempt. This can muddy the waters when doing any testing. For reasons unexplained the latest 23.09 dev firmware is more likely to make a PPPoE connection at first try. So there is hope that things are getting better for UK-style connections.

I hope this adds some UK-orientated clarity!

☕️

Yes, there are many ways you could do this. Really having the TP-Link as the main router is restrictions here. If you have something else behind it as a VPN server that creates a local routing problem if it's i the same subnet as hosts that need to connect to the remote VPN subnet.

If you can't swap out the TPlink for pfSense then consider what it can do and build anything else around that. If that can do Wireguard it would likely work since Wireguard inherently includes routing.

Nice catch.

Yes, exporting and manually removing that from the config should correct it.

@macaruchi said in Vlan wifi doesnt connect:

There is a way to send any packets to this vlan to test the conectivity?

Connected a PC or laptop to the pfSense interface an configure it's network port for this VLAN.

@cornerstonefound said in Guys, totally new, I need 3 ports to connect to different things from minipc how simplest way?:

Do I set all this up in the pfsense GUI and so on?

Yes. At the first boot after install you would assign the NICs to interfaces at the console. Then connect to the webgui on the LAN interface and configure the other interfaces.

Steve

@stephenw10 I see, thank you very much for your answer 😁

You'll also be able to see the interface names at the console or by running ifconfig at the command line.

What version did you upgrade from where it was working?

@stephenw10 My ISP finally called me back this morning and said that it looks like the box outside is going bad. They are rolling a tech to replace it this morning. Will see what happens.

@mcury The mistake I was making was to enter the username just as straight text, ie "pfsense". When I switched to "CN=pfSense,CN=Users,DC=lan,DC=company,DC=com" the bind authentication started working.

The authentication appears to be working. Now on to making it secure.

Thanks for posting the screen shot.