Upgrade 2.5.2 to 2.6.0, upgrade success, Limiters not passing
-
@blikie said in upgrade 2.5.2 to 2.6.0, upgrade success, no internet conection:
do with the newer unbound version on 2.6.. just a theory.
I'm following upstream unbound development. pfSense doesn't include the latest version, but 1.13.2 is known to be good.
This : the last two rules are the "limiter rules" for the IPv4 and IPv6 interfaces :
The situation :
at home, using pfSense 2.6.0 in a VM, this works.
at work, identical pfSense 2.6.0, same WAN type interfaces, upstream router/ISP - it doesn't.As far as I know : only NIC drivers are different.
-
@blikie said in upgrade 2.5.2 to 2.6.0, upgrade success, no internet conection:
But when u have more than 1 LAN interface active, limiters block internet access
Meaning, if you disable all but one LAN it starts working? (maybe needs a reboot??)
-
Traffic Shaping with fq_codel worked just fine for me after upgrading from 2.4.5-p1 to 2.6.0, even with dual wan, but unbound did not play well, hence I downgraded ...
-
I am wondering how even 2.6.0 is officially released if two of the basic functions are not working at all!!
I have struggled with the no connection issue, had two sleepless nights for just figuring that out, and rebuilding my system on 2.5.2.
Thank goodness I still have a copy for the 2.5.2 installer image (they have removed it from the download links) quickly as fuck..
When I tested 2.6.0, limiters broke the internet connection, even the captive portal was having issues.
One issue for the captiveportal is that ICMP ping is not allowed for authenticated users !! and there is no setting to change this behavior!
Also, sometimes the captiveportal failed to provide normal internet access after a successful login.
My iPhone still asks me to login to the network, and when I do, I actually get the logout page (because I am actually logged in but the captiveportal still interrupting connections! )
Not even a single workaround to get it working, the only solution was to reinstall 2.5.2
Also, and before reverting to 2.5.2, I tried 2.7.0-DEVELOPMENT, just to try it by the way before reformatting..
Same issues!
Seems like 2.5.2 will be the golden release lol.
I am really disappointed, I feel like the release team has no idea about the proper software testing and releasing process.
And it’s more annoying when they remove the old stable release and quickly marking it as “deprecated “ in the update channel selection screen.
If that’s the current readiness status of 2.6.0 and they deprecate 2.5.2, what if it was stable then lol?!!
-
2.5.2 is still available. So is 2.5.1 if you really wanted it:
https://nyifiles.netgate.com/mirror/downloads/Limiters in general work fine. I've been trying to replicate this issue and so far have failed.
Do you have any data from the captive portal issue? Similar to the reported udp issue, no outbound NAT? https://redmine.pfsense.org/issues/12834
Steve
-
Just wanted to chime in on this thread and mention that Limiters/FQ-Codel are working fine for me as floating rules on 2.6.0/22.01 using the instructions from post number 815 in the long FQ-Codel thread:
https://forum.netgate.com/topic/112527/playing-with-fq_codel-in-2-4/815
Hope this helps.
-
@neothesdony said in upgrade 2.5.2 to 2.6.0, upgrade success, no internet conection:
any one have the same issue?
No, working fine here.
-
I decided to update a 3100 we have that has limiters on most firewall rules on (the only) LAN, and all seems fine.
-
@steveits I'm currently checking it, and seems my Limiters block internet connection on interfaces of our XG 7100. How did you setup your limiters please? Thanks.
-
@georgecz58 said in upgrade 2.5.2 to 2.6.0, upgrade success, no internet conection:
How did you setup your limiters
How many of your interfaces have limiters? Above posts imply it's a problem if using limiters on more than one.
For our use the LAN rule allows from a specific IP to any, and:
and the Upload3m limiter:
-
My setup was usualy easy . I had limiters on only 2 interfaces - one is for guests and one for mobile phones. Before update it was working corectly, now it works only till I didnt run bigger upload/speedtest etc.. Then something happen and I cannnot reach internet anymore. This is setup of limiter:
-
@georgecz58 Can you remove limiters on one of the two interfaces, for testing? Or maybe disable the guest interface?
I see our limiters use different schedulers…
-
@steveits I have limiters on both WANs (DSL & LTE) and they worked fine in 2.6.0.
Does no one else have issues with the DNS Resolver in 2.6.0? For me it randomly stopped responding to requests on some network interfaces - presumably those that have been inactive for a while. The only workaround was to manually restart the DNS Resolver. So basically "upgrade success -> no internet connection" for me as well ...
-
Thank you!
I didn’t notice it, so could you please let me know where this mirror list is linked to? -
If you just click 'download' on the download page without selecting anything it will take you to the list.
Steve
-
S SteveITS referenced this topic on
-
@steveits I test also your setup. Also tested with only one interface. Now i tested again and I find, that ping is working. So only DNS stopped to work here.
-
Are you able to see if that's all udp traffic or just DNS?
-
@stephenw10 I dont have idea how can I check if is UDP working, without dns - can you give me advice please :-) ? There is temp W server 2019 running, I can install on it whatever we need.
-
The same thing happened to me yesterday after upgrading to 2.6.0. I dont even have limiters set up. At first i thought it might be a realtek issue but i tried installing the drivers from here https://forum.netgate.com/topic/166746/realtek-re-kmod-missing-in-pfsense-2-6-repository and same thing happened still no internet. It might still be a realtek driver unless someone here with different NIC experiences the same problem. Check using Diag > Ping and the pfsense able to ping websites it just cant give internet to my network.
So i gave up for now and reverted back to 2.5.2
-
Most clients will attempt to send ntp traffic at least. You should see that in the states. It will probably try to use the interface IP directly though which may not hit the issue.
You can just try a udp traceroute.Steve
