Hmm looks like the APs can ping pfsense.
I took turns plugging them in to ping 192.168.1.1

Now I have an entry in the ARP table for both of them and pfsense can ping them.
b303b00c-d54c-48d6-9ead-a11e71d03196-image.png

My desktop still can't ping them or access their web gui.
I still can't have both of them connected at once, but I guess that's one problem solved?

For anyone stumbling around in the future,
The issue was double NATting on my CenturyLink router that was in bridged mode.
I bypassed it completely by plugging directly into the modem and setting the VLAN to 201.

I figured it out!
The culprit was Microsoft's new Edge Browser.
I tried with Chrome and it worked perfectly.
I hope this helps someone else!

Well sure if you can't do dns then internet doesn't work very well ;)

Do a simple query from a client with your fav dns tool, nslookup, dig, host, etc.

Does www.google.com resolve? Can pfsense resolve - go to diag menu on pfsense dns lookup for say same www.google.com do you get back an IP?

Where are you pointing clients for dns? Pfsense IP I would assume? Out of the box pfsense would resolve for dns, vs forwarding..

Not sure what your trying to accomplish with those switches that seem to be doing routing? Where do the clients point for gateway? The switch IP or pfsense? What IP do you have on pfsense in those vlans? Sure hope its not .0?? How exactly are you routing between the switches - you show them connected with their e0/1 interfaces - but you list no IPs on them - is that a transit network?

On a side note - why the use of /20?? Such a mask makes no sense in a lab setup, why would you not just use /24s? Makes it much easier to tell where the network breaks, etc.

@JKnott thank you very much for the information and insight greatly appreciated 👍

@stephenw10 said in pfsense drops wan (PPPoe) when using speedtest.net:

I assume the I

Yes this is VDSL, the ISP device is in bridge mode and pfsense does PPPoe.

FeedBack :

There is no hardware failure related issue reported in System logs.
I am monitoring the system remotely.
CPU usage showing 7%-8%.
Memory usage is 27% (out of 4GB RAM).
Approx 50-60 users are connected.

Waiting for the problem to reoccur.

@stephenw10 - Thanks Steve! I've added those 4 addresses as "other" and I'm sure that will come in handy later on when I need to use those addresses for other purposes.

Right now I'm using them only to temporarily solve a strange problem I'm having with two websites not responding to two of my users unless their from address is a different address then my primary one.

My ISP is trying to run down this problem but for now this 1:1 NAT workaround is getting the job done.

Roy...

I think i have narrowed it down. Your questions about my hardware made me look into my switch a bit more. It is "passively" cooled but as it is in a cabinet it seems it isn't getting enouch airflow. I turned it off for a period of time and back on and i'm getting good speeds with no packet drops.

I have already ordered a fan that i can put inside. Thanks for all the help!

@serbus

I have a APC UPS and then a APC 7900 PDU connected between them.

I do have NUT setup and appears to be working right now. However, next time I am home I am going to manually cut the power and test just to double check.

So far so good, as it has now been over 3 hours without a reboot since I forced an automatic system check on reboot. However, I did make some other changes (disabled PIMD, etc.) that may affect the frequency of the reboot. I am fully backed up and hoping for the best, but prepared for the worst. I will reinstall from scratch and restore from backup once I am back on site.

I also plan on enabling RAM disks now as well.

@qtwrk
Since wired devices work, it's not a pfSense problem. IPv6 relies on multicasts for several functions. As I mentioned, RAs are used to provide address info. All a router does is send out the multicast with the appropriate info. About the only thing that could cause a problem would be bad info. However, that would affect all devices, not just WiFi.

In outbound NAT rules, i specified the Interface address as VIP address,

a19f0df6-9812-48dc-bbeb-104711785854-image.png

Now it works! Solved!

Thanks. I am running fsck now through ssh 5 F.

My configuration is pretty basic. Just VLAN interfaces set as downstream so that pfsense acts as the IGMP Snooping querier for the switches. I don't actually require mcast routing. Anyways, I manually copied over the config file from a 2.4. 4-RELEASE-p3 box and started IGMP proxy from the CLI. Since then its been working fine and I can make changes from the GUI.

Yeah, you need NAT to reach anything from an internal non-routable IP as you found.

Try running at the command line: pkg -d update
What error does it report?

Steve

Did you actually see a crash report? Normally indicated by an alert i the GUI after you reboot.

If not what exactly happened? pfSense became unresponsive? Even at the console?

Torrents typically cause problems because the open a lot of states. That can exhaust something on smaller pfSense boxes though just one torrent client is not normally anywhere near doing that.

Check the monitoring graphs (Status > Monitoring), look at the state usage in the time leading up to the incident.

Steve

I no issues with either of those. There will be some variation in your own switch.

Just remember that you are removing pfSense as the filter between the VLANs. Any filtering you need there now has to be done using ACLs in the switch. That also means you now have two places to check for filtering rules when troubleshooting so be aware of that. 😉

Steve

FYI...Turned out that my 24-port switch was bad. New switch = No Problems!

You can set an expiry date for local users sure.

https://docs.netgate.com/pfsense/en/latest/book/usermanager/user-management.html#adding-editing-users

@OpenWifi said in Do i need to to Turn Off NAT on my Mikrotik router,while Pfsense hanfout Leases:

pfsense has so many great features that Mikrotik doesn't

That's why I prefer pfSense at the edge.

@OpenWifi said in Do i need to to Turn Off NAT on my Mikrotik router,while Pfsense hanfout Leases:

Ntopng lets me see what traffic is going through my network

For this you would need to disable NAT on the Mikrotik else all traffic would be coming from 192.168.1.100

@OpenWifi said in Do i need to to Turn Off NAT on my Mikrotik router,while Pfsense hanfout Leases:

I dont have to go to each and every of my client to set the static lease, the way Mikrotik does.

In Mikrotik, go to IP > DHCP Server > Lease ... if you click on the lease you'll see an interface tab like below ... notice one arrow points to "D" dynamic lease that you can "make static."

Screen Shot 2020-07-24 at 10.26.59 PM.png