Device stopped working

stephenw10

SSH was enabled but just isn't responding?

But it's still routing traffic I assume if you're able to access things behind it?

I also assume the serial console is not hooked up to anything?

If all that's true there mat not be much you can do.

Steve

hunor

@stephenw10

Thank you for your answer. Yes, it is still routing but I guess only the available routes. All DHCP lost connections.

Sadly the cable is not connected to any other device, so I can’t use the console.

SSH was enabled, I checked the backup file on my computer but it’s not responding. :(

stephenw10

Hmm. SSH is on the default port?

Have you been able to connect to it previously?

What pfSense version is it running?

Steve

hunor

@stephenw10

It is the latest version of pfSense.
I don't think I ever connected with SSH, and according to the config file, it is port 22.

Interesting fact, that it happened after I verified my noip hostname. However, my public IP address doesn't change.

stephenw10

Mmm, probably coincidence. Without being able to see any logs or run any tests it's hard to say what happened.

As a complete guess I'd say you have hit this: https://redmine.pfsense.org/issues/12095

Steve

hunor

@stephenw10
Thank you!

I have a log file, because I used my Synology to collect logs.
Here is a link to the csv file.

stephenw10

Hmm, massive file!

But there's not actually that much interesting in it. Are you exporting all logs?

The last thing shown (after removing the filter logs) is:

2021-09-13	07:02:10	Information	pfSenseHunor.168Harrison.mylocal	daemon	unbound	[23739:0] info: service stopped (unbound 1.12.0).

But there is nothing leasing up to that showing why it might have stopped.

There are no out of memory/SWAP errors.

Looks like you have Snort running. Is it in blocking mode?

Steve

hunor

@stephenw10

Yes, I have routed all log information.

Yes, snort is in blocking mode.

I tried to add DHCP/DNS on the Synology, but no luck. I have some access to my files, but I learned from my mistake. Thank you for your help.

hunor

@stephenw10
Thanks to some miracle the connection is restored. Can you please help me to figure out why? Because at this point I am really curious. :)

stephenw10

Snort was blocking something and the block expired? Check the alerts.

Something else caused it to reboot? Check the uptime.

Review the system logs.

Steve