Errors should log to Status/System Logs/System/DNS Resolver. It should attempt every 5 minutes unless the default timer was changed.

Updated my unofficial guide if anyone else wants to try this here is a short guide for you.

https://forum.netgate.com/topic/195843/unofficial-guide-have-package-logs-record-to-a-secondary-ssd-drive-snort-syslog-squid-and-or-squid-cache-system

@CatSpecial202 That looks correct to me.

@vMAC yeah your 10ge would just be your lan.

@aGeekhere Okay, so the real trouble is actually because of the few clients that you want to bypass the DNS filtering done by 1.1.1.3/1.0.0.3

1: Unbound DNS in pfsense by default does caching of all DNS lookups as TTL records allows. This is the same caching as Lancache does unless you start configuring some out of spec extra caching (of invalid records). If that is your reason to keep lancache in the loop configure Unbound to do the same (out of spec) caching of stale records - it can be done in the advanced settings.

2: Configure Unbound in pfSense to use forwarding instead of the default root recursive resolution. Then Unbound will do all lookups by forwarding to the DNS servers in "SYSTEM -> GENERAL -> DNS Servers"
It will still cache all records, so just hand the clients your pfSense DNS and drop the lancache server.

Using forwarding mode prevents us from exempting specific clients from being DNS filtered pr. the forwarding servers filters. So to have a few clients NOT being filtered things become a little more troublesome. For this you could:

1: Keep the lancache servers for those clients - make a DHCP reservation with a DNS override to hand them the lancache server as the only DNS
2: Configure Lancache to use your preferred public DNS as forwarding servers (1.1.1.1/1.0.0.1).
3: Create a stubzone on Lancache for you internal domain name for clients (the domain name used for your overrides in pfSense), and point that stubzone to forward to pfSense instead of 1.1.1.1/1.0.0.1

This will create the scenario you are looking for.

They are regex fields, so 192\.168\.174\.1$ should exactly match the .1 address and only the .1 address. It works for me here, with or without the starting anchor (^). In this case you shouldn't need the start anchor but for an address with 1-2 numbers in the first octet, it could be necessary.

If that doesn't find anything then there may not be any matching logs for that one address at the time you searched.

Yes is this only happening when a client connects to the server and starts moving files?

Is that traffic going through pfSense?

Is anything logged in pfSense when that happens?

Yup that^. Use IPAlias VIPs on the main CARP VIP instead of multiple CARP VIPs. Reduces CARP traffic and the numerous scripts that get run for each VIP state change.

Yes from 2.4.4 I would just install 24.11 clean and restore your config. That's a big jump from 2.4.X, you'd need to run several upgrade steps otherwise.

@Bogart-ICQa said in After upgrade 24.03 to 24.11 reboot hangs at start @ 0xffffff....:

The upgrade process itself completes but the box is not rebooting into the new version. Its just is stuck with solid light orange, purple, blue.

What does the console show while that is happening?

We hope to have something sooner than that. But, as always, it depends how the development/testing goes.

@provels I want the device to be at the same address regardless of physical connection type.

Using just the conservative setting for the firewall and giving the ip phone static ports, has always worked for me. You should not have to change TCP/UDP settings specifcally. Just the firewall optimaztion. see the pic for the detales of the differances.

Screenshot from 2025-01-07 07-22-08.png

@Decepticon Thanks for the reply. This is an IPSec VPN, and I use the gateway monitoring for multi-wan failover. The IPSec gateways don't show in that section but do think it has something with a route not advertising.

Danke Viragoman!

Hab es eingerichtet, finde die Einrichtung allerdings nicht wirklich trivial und nicht gerade selbst erklärend.
Anbei ein paar Screenshots der Einrichtung.
Wenn ich es so einrichte, bekomme ich einen Fehler auf dem Mailgateway.
Evtl. fällt euch der Fehler auf.Mailserver.JPG Frontend2.JPG Frontend1.JPG Backend.JPG

@dacuda said in Migrating 24.03 to New Hardware:

I originally was on CE, and took advantage of the free upgrade to plus when it was previously available.

I was on the very similar boat and if you on free-upgrade (CE -> Plus) then tac-support won't do it. I was told that free upgrade is tied to the H/W, hence cannot be transferred.

-S

@bmeeks

Thank you the symbolic link did just what I needed, great idea

ln -s -F /mnt/LOGS_Optane/snort /var/log/snort

This did the trick with the mount point I had to delete the old directory first /var/log/snort and recreate it after because at first it would say it is not empty

Updated my unofficial guide if anyone else wants to try this

https://forum.netgate.com/topic/195843/unofficial-guide-have-package-logs-record-to-a-secondary-ssd-drive-snort-syslog-squid-and-or-squid-cache-system

@viragomann Thank you for mentioning CSOs, I was missing the CSO for the new building thus the VPN connection wasn't working properly. I cloned the existing one and everything works fine.
Thanks and have a nice day!

@viragomann oh yeah that can be on my pi‘s I have virtualmin! I‘ll change that up Adressen on the pi!

@stephenw10

I’ve been running on “previous stable” firmware.

In response to this most recent drop I upgraded firmware on this SG2100 from 2403 to 2411, removed or disabled several non-essential add ons, and disabled gateway monitoring entirely.

crosses fingers