Hmm, but it is somehow routing traffic on every interface?

Can you ping out from the console to anything?

Please disregard. The field looks grayed out but it turns out you can actually change the values. Sorry!

(Side note - BIND stopped writing to resolver.log after I changed the setting but I was able to fix this by restarting the named service on Status > Services)

It probably is fixable. You might be seeing that error temporarily anyway.

But try running at the CLI:

pfSense-repoc -N

pkg-static -d update

What error(s) are shown?

Steve

@jimp The Unbound crash happened again today. The Unbound crash has not happened in months, particularly since reducing memory size parameters. It's been so long, in fact, that I removed service watchdog a week or two ago, thinking the issue was resolved. So much for that.

Here's various symptoms:

The only relevant error message I found in the System>General log is: Nov 24 10:57:21 kernel pid 54097 (unbound), jid 0, uid 59, was killed: a thread waited too long to allocate a page

Note this error is different than those in the past where Unbound was killed failing to reclaim memory. End result is the same: dead Unbound and dead production on my network (without service_watchdog, which I have now restored to service).

I haven't found any relevant messages in the Unbound logs.

The Status>Monitoring>System>Memory shows a puzzling zeroing of all parameters at about the same time as the Unbound crash:

f65f0225-4352-4253-801a-02172f323524-image.png

So, while I've been admonished in this forum to not use service_watchdog, I can't maintain production uptime without while these Unbound discrepancies live on.

If there's something more I can do to assist Netgate in figuring this out, please let me know. I'll be happy to do whatever I'm able.

Thanks!

After fixing the backup node, i encounter the exact same issue on the master node...
Snapshot before reboot to be able to recover the config file !

Using Spectrum as ISP and was pulling my hair out on why the Netgate sg-2100 wasn't getting a WAN ip address. After unplugging the modem and the Netgate for a few minutes, then plugging in the cable modem then the Netgate did it get a WAN IP address on the device, thanks!

@stephenw10 Thx! It works :-)

Thanks again for your replies.

I enjoy playing around with all this networking and security stuff.

Very exciting.

And pfsense is the best!

And a great support community - thank-you.

But like home, pro, server etc?

No that's not possible. And you really don't want to have that sort of service on a firewall anyway.

@dutsnekcirf said in Convert pfsense ova file to qcow2 fails with either virt-v2v or qemu-img:

I'm wondering how well this works.

Very well. All the config is in that file. It should restore and be identical. The only issue you will have are he interface names will probably be different (vmx vs vtnet) so they will need to be re-assigned when you import it.

Steve

@Antibiotic get rid of that torrent client eventually it’s gonna break stuff if you keep using it. Trust me. Stop using it, think about how many ports you need open. It just takes one bad download

@stephenw10 I'm also noticing this behavior. I'm on pfSense version 24.03-RELEASE.

@stephenw10

Both really.

My infrastructure segment is inaccessible unless you can either get on that vlan through a physical port on the switch, or via a VPN that the FW originates as the server to get on an administrative network.

There are also client mode VPN connections to a commercial provider.

Regardless of if the traffic is coming in via the admin VPN and then out WAN, or on the local segment and then routed over the client VPN out to the web it takes a big hit to throughput. It would be difficult to pin down if it affects traffic both ways given the huge imbalance in the down/up speeds.

It does seem to be limited to traffic routed externally that has the issue though. Running a speed test from the admin net to a local server works as expected despite going through a vpn tunnel to get to that network. But anything either from the admin vpn or going over the external commercial vpn to an external site is heavily limited.

Thank you very much for your help. It works now! I have just reinstalled the pfsense.

Mmm, I'm not sure we can anything about that. The webgui handles that formatting fine.

I believe that's actually the syslog version, which i9s part of the expected format.

If you created the VM in ESXi 8.0 then it's probably OK. But the VM version is separate to the ESXi version.

Yes it should do that anyway. If you renew the cert for example.

@jriofrio
Just to corroborate your statement about (in my case) not need it to disable the hardware checksum with the intel x540.

You are correct, I enable it back and reboot the firewall, tested the connection of OPT1 (2nd LAN) and all works good, no problems accessing websites.
Also, I deleted the DoT rule for the 2nd LAN.

All good.. I'm please with the results.

PS: couldn't sleep , so i decided to do the changes now that no one is using the internet....

@kprovost Though my eye is untrained, I would agree that mine looks very similar. It has happened only once, so I will keep an eye on it and watch for when 24.11 goes GA. Thanks.

--Larry