Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    UDP/ICMP is not working after upgrade to 2.6.0

    Scheduled Pinned Locked Moved
    Captive Portal
    8
    20
    3.2k
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • bepoB
      bepo
      last edited by

      Hello,

      I also noticed problems with Outbound NAT regarding to UDP traffic.

      Packet Capture on OPT1:
      269eed95-6878-4075-afa8-467b3e66408a-image.png

      Packet Capture on WAN:
      34230165-259c-4a26-aaae-7231009479ab-image.png

      So it seems the traffic is leaving the interface with working translation, but pfsense does not correctly forward the returning packets to the sender. This is also happening to simple DNS requests so its not a problem with OpenVPN.

      Unfortunately, this strange behavior is limited to some interfaces. It happens on OPT1 but not on LAN.

      NAT Rules are exactly the same except the source network.
      3d7a8460-7214-4fea-a046-65054d9c942c-image.png

      Any hints for further debugging? Avoiding udp is not a proper way I'm afraid...

      Please use the thumbs up button if you received a helpful advice. Thank you!

      P 1 Reply Last reply Reply Quote 3
      • P
        pdschulz @bepo
        last edited by

        @bepo This is happening to all Captive portal enabled interfaces for all UDP traffic. Disable captive portal or downgrade to previous 2.5 version. 2.6 it appears broken after doing traces same as you did.

        Cool_CoronaC 1 Reply Last reply Reply Quote 3
        • bepoB
          bepo
          last edited by

          Thanks for this hint @pdschulz. Indeed there is a captive portal enabled on this interface. I opened a bug for this:

          https://redmine.pfsense.org/issues/12834

          Hopefully it gets fixed soon.

          Please use the thumbs up button if you received a helpful advice. Thank you!

          1 Reply Last reply Reply Quote 1
          • J
            jake
            last edited by

            I'm having the same issue with Captive Portal on an VLAN interface. I thought it was just a configuration problem.

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Ok, I've replicated this but I don't think it's anything to do with NAT The created NAT states looks correct.
              It looks more like the Captive Portal itself is only passing TCP traffic outbound when you hit this.
              Digging....

              Steve

              1 Reply Last reply Reply Quote 0
              • stephenw10S stephenw10 moved this topic from NAT on
              • Cool_CoronaC
                Cool_Corona @pdschulz
                last edited by

                @pdschulz I didnt run CP on any interfaces and still no dice on 2.6

                On 2.5.2 it works and runs happily

                ? 1 Reply Last reply Reply Quote 0
                • W WorldDrknss referenced this topic on
                • ?
                  A Former User @Cool_Corona
                  last edited by

                  @cool_corona

                  I can confirm I had similar problems after upgrading to 2.6.0.
                  Setup: pfsense 2.6.0 with Unifi AP's and captive portal.

                  My first indication is that 3 different Mibox devices, running Android TV, came up with "internet connection problems". On the settings page I could see "connection, but no internet".

                  Most application on the mibox did not work, no amazon prime, no youtube, no vrtnu, ... BUT netflix worked.

                  Ipad and android phones did work however.
                  Linux / Windows laptops also seem to work.

                  On the Unifi Network Management Station I got "STUN" errors on the access points after the upgrade.

                  Disabling the captive portal and re-connecting the clients fixed the problems.
                  The STUN errors on Unifi also disappeared.

                  GertjanG 1 Reply Last reply Reply Quote 0
                  • GertjanG Gertjan referenced this topic on
                  • R ricardopeu referenced this topic on
                  • GertjanG
                    Gertjan @A Former User
                    last edited by

                    Read https://forum.netgate.com/topic/170300/new-system-patches-v2-0?_=1646343673426 - Apply patch (Redmine #12834) and case closed.

                    No "help me" PM's please. Use the forum, the community will thank you.
                    Edit : and where are the logs ??

                    1 Reply Last reply Reply Quote 2
                    • bepoB
                      bepo
                      last edited by bepo

                      Maybe we should move discussion to the ticket only to prevent splitted information:
                      https://redmine.pfsense.org/issues/12834

                      I posted an update there. Its maybe still an issue with mac address bypasses.

                      Update: Its fixed. You have to reboot after applying the patch! Thanks for fixing :-)

                      Please use the thumbs up button if you received a helpful advice. Thank you!

                      1 Reply Last reply Reply Quote 1
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        Only the mac bypass? How are you applying that? Hosts behind the portal that should be able to connect without logging in?

                        bepoB 1 Reply Last reply Reply Quote 1
                        • bepoB
                          bepo @stephenw10
                          last edited by

                          @stephenw10 See my update. It was my fault not rebooting after patching. Thanks!

                          Please use the thumbs up button if you received a helpful advice. Thank you!

                          1 Reply Last reply Reply Quote 2
                          • GertjanG Gertjan referenced this topic on
                          • RuddimasterR Ruddimaster referenced this topic on
                          • S SteveITS referenced this topic on
                          • GertjanG Gertjan referenced this topic on
                          • B
                            BENROFU
                            last edited by

                            I have a netgate Sg1100 with 22.01 release. I use captive portal, and cannot get wifi-call.
                            I have changed state timeouts on UDP as suggested in other posts but no diffrence.
                            Could it be that my pfsense+ 22.01 equals to 2.6.0 you are referring to here?

                            I tried to upgrade my system firmware yesterday but with no sucess. I see a lot of other with same problem with upgrading.
                            Still awaiting link to a recover image from netgate. Re-installed and old recoveryfile and back in business, but without wifi calls...

                            Can someone please shed some light on this issue?

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              You need to apply the patch for captive portal in 22.01.

                              Or upgrade. How did it fail?

                              You will get the recovery image imminently though and installing 23.05.1 clean is probably a good idea if you have access and a backup config.

                              Steve

                              B 1 Reply Last reply Reply Quote 0
                              • B
                                BENROFU @stephenw10
                                last edited by

                                @stephenw10 Thanks for reply. I tried upgrade via webgui.

                                a7a78d8e-d7b5-40d7-aeed-07010d3b7a7f-image.png
                                Never booted up again.

                                Connected serial and rebooted to this.
                                deb7adfb-c4d6-458b-a3ab-79577e86db29-image.png

                                1 Reply Last reply Reply Quote 0
                                • stephenw10S
                                  stephenw10 Netgate Administrator
                                  last edited by

                                  Ah, Ok. Yes that was a known bug back in 22.01. Easier to reinstall 23.05.1 clean and restore your config from there.

                                  B 1 Reply Last reply Reply Quote 0
                                  • B
                                    BENROFU @stephenw10
                                    last edited by

                                    @stephenw10
                                    Yes, but if i do understand correct i cant download firmware updated, i need to open ticket with netgate?

                                    I assume i have to wait and see if i get a reply for the ticket i just opened.

                                    thanks again

                                    1 Reply Last reply Reply Quote 0
                                    • stephenw10S
                                      stephenw10 Netgate Administrator
                                      last edited by stephenw10

                                      Yes. But I can see we replied to your ticket with a link ~30mins ago. (6mins after it was opened)

                                      B 1 Reply Last reply Reply Quote 0
                                      • B
                                        BENROFU @stephenw10
                                        last edited by

                                        @stephenw10

                                        Yes thanks! Just trying to install it now!

                                        B 1 Reply Last reply Reply Quote 1
                                        • B
                                          BENROFU @BENROFU
                                          last edited by

                                          @BENROFU Perfect, with wifi calling 👍

                                          1 Reply Last reply Reply Quote 1
                                          • First post
                                            Last post