Hmm, it seems like something must have changed that is now consistently triggering it. That might be something external.

@jmickens

It seems I was using a container name and not a user group. Once I changed to a valid security group, it started working.

It seems to have been a DNS issue. The default settings were set to DNS Resolver after factory reset and first setup, which was probably the culprit. I turned it off and turned on the DNS forwarder instead, and now the internet works better than ever!

@stephenw10 @Derelict Thanks for your help~ I still don't exactly understand how that was an issue, but it works now. Have a nice day :)

@lewis no problem - glad you got it sorted..

Yes, the firewall rules in pfSense should allow you ping between all the subnets. Or send any IPv4 traffic.
The clients in those subnets have to accept traffic from other subnets though.

How is that traffic shaping queue defined? What settings have you used?

It could be so restrictive that traffic put into it is failing.

Try removing the queue from that rule and retest.

Steve

The ISP is handing the gateway as a private IP and that's common for a PPPoE link and not normally an issue. I have that here. But, yeah, using a 192.168.x.x address is far more likely to conflict.
However, exactly as I also see, that gateway does not respond to ping. You should set the monitor IP to something further upstream like 8.8.8.8 so you get real monitoring data for the link.

Steve

@steveits hi thanks for the reply. I tried what you suggested but unfortunately nothing

@jimp your description fits my case exactly. Thank you very much, this solved my issue.

Have a great day,
Mauro

@rcoleman-netgate said in Is APU1c good for latest versions of pfSense?:

@joea IIRC this is what I did on mine last year.
. . .

Thanks. Just one more step required.

@stephenw10 Thank you, I was not aware of the « Use non-local gateway » option but setting the gateway using the cli instead of the web interface seems to automatically detect wether it’s local or not and now it working as expected.

Thank you all for your time of the explanations.

Yep, you would think. Except errors maybe. But worth checking, we've seen weird things like that before.

Yeah, it returns 'pfSense' there intentionally. Anything else would be uncontrolled if it's not hardware we know about.

You can read through the thread where this was initially diagnosed here:
https://forum.netgate.com/topic/173923/strange-error-there-were-error-s-loading-the-rules-pfctl-pfctl_rules

I doubt anything can be learned at this point since the reported errors from there will always be 'device busy'. As shown there we need to see the truss output leading up to the point where is gets stuck which is the first time pfctl is run for this that were hitting it consistently.

Steve

Not really unfortunately. None that I'm aware of at least.

You would probably want to use the DNS blacklist feature in pfBlocker to filter requests made against the resolver in pfSense.
By default pfSense will pass it's own interface IP to use for DNS via DHCP to clients. You can also force clients to use that rather than something hardcoded:
https://docs.netgate.com/pfsense/en/latest/recipes/dns-redirect.html

You would then add clients you want to be unfiltered as static dhcp leases and set a different DNS server for them to use.

Steve

@bob-dig said in Performance on Hyper-V broken by Microsoft Dec 13 patches?:

@stephenw10 Is this sysctl. in the pfSense GUI in System-Advanced-System Tunables presant? I don't see it in 22.05.

Not by default but you could add it.

It shouldn't be needed because the default values there should be to disable the RSC behaviour. It doesn't appear to be here for some reason.

Steve

@wintok Hi wintok,

I have another option for you that may assist you with overcoming your problem.

I have just noticed that FreePBX has OpenVPN available.
pfSense also has OpenVPN available.

Setup a VPN tunnel between FreePBX and pfsense then let your phones communcate with FreePBX over the VPN tunnel. It should then be a matter of traffic rules to get it all working.

Here is a link with some instructions.
https://wiki.freepbx.org/display/FDT/%5BHow-to%5D+Setup+VPN+between+pfsense+and+FreePBX

Cheers

Yup re-installing on a new hard drive should not be a problem. As long as the NDI doesn't change you will be able to see the upgrade repo and re-upgrade to Plus.

Steve