Problems between iphone and dhcp?

edpbettinelli

@steveits said in Problems between iphone and dhcp?:

During that minute, does it respond to pings on other interfaces?

yes, even non-iphone devices on the same vlan respond to pfsense ping

johnpoz

@edpbettinelli are you saying you can not ping an iphone by name when unbound is restarting - this would make sense.

Or are you saying iphone can not ping pfsense IP on the iphone vlan? By IP? By name?

If unbound is restarting - then yeah you could have issues with resolving anything by name.. But that should not effect ping by IP..

Registering dhcp leases in unbound has been problematic for quite some time, because any time a lease is redone or issued it forces a restart of unbound, etc.

SteveITS

@edpbettinelli said in Problems between iphone and dhcp?:

even non-iphone devices on the same vlan respond to pfsense ping

That makes me think it's more of a wireless+phone issue than a pfSense issue.

edpbettinelli

@johnpoz said in Problems between iphone and dhcp?:

are you saying you can not ping an iphone by name when unbound is restarting - this would make sense.
Or are you saying iphone can not ping pfsense IP on the iphone vlan? By IP? By name?
If unbound is restarting - then yeah you could have issues with resolving anything by name.. But that should not effect ping by IP..
Registering dhcp leases in unbound has been problematic for quite some time, because any time a lease is redone or issued it forces a restart of unbound, etc.

the effect is that all apps are blocked, with an app on iphone i verified that ping using ip. other iphone or voip phones on the same vlan respond to ping, while if in that minute I try to ping pfsense no response.

johnpoz

@edpbettinelli ok I just started a ping to my iphone IP 192.168.2.198

I restarted dhcp, I even did a manual reload of all the firewall rules..

Not 1 ping dropped.

Ping statistics for 192.168.2.198:
    Packets: Sent = 124, Received = 124, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 2ms, Maximum = 322ms, Average = 73ms
Control-C

from a box on another vlan to the wifi vlan the iphone is on...

edpbettinelli

@johnpoz sorry I didn't understand, did you ping from iphone to your gateway or from pfsense to iphone?
I see the problem from iphone to pfsense

Sorry for my english

stephenw10

So during the failure you are still able to ping pfSense from other devices?

If pfSense itself stops responding then it does sounds like know pf reload issue:
https://redmine.pfsense.org/issues/12827

Steve

edpbettinelli

@stephenw10 I confirm that with all other devices except iphone pfsense does not lose a ping. it seems like some strange management of wifi by apple

johnpoz

@edpbettinelli ok on my iphone.. Pinging pfsense IP on that vlan.

Restart unbound, reload firewall filters, restarted dhcp, etc..

Not a ping lost

PNG image.png

stephenw10

Mmm, there's really no reason the iphone should react at all to dhcpd restarting.

Can we see your test results so we know exactly what you're seeing?

Steve

johnpoz

@stephenw10 said in Problems between iphone and dhcp?:

there's really no reason the iphone should react at all to dhcpd restarting.

exactly - the only thing I could see having any possible effect at all is a reload of the firewall rules.. if that got hung up then maybe ok, but states are not flushed on a reload, I don't think that is a default setting - mine don't flush the states, etc..

So if you started a ping just as the firewall rules were reloading I could see maybe an issue?

edpbettinelli

@johnpoz Last night I tried from home in vpn to reload the rules I am attaching the ping screen to pfsense.

There was an iphone connected which never lost the ping during all my tests (the ping, however, was from my pc in vpn to the iphone).
This morning I tried to activate a dhcp on a test vlan and my iphone crashed as usual,
while the rest of the devices had no problems (same behavior of the attached snap).
I forgot the iPhones are managed by a mdm in the cloud.
Other tests I will be able to do only when the company is stopped.
Do you have tests to recommend to me to get more data to find the cause of the problem?
Thank you very much for your support, I will keep you updated on the developments.
Luca Bottini

stephenw10

@edpbettinelli said in Problems between iphone and dhcp?:

my iphone crashed

I assume you mean it was unable to connect out via WIFI?

It didn't actually crash?

edpbettinelli

@stephenw10 said in Problems between iphone and dhcp?:

I assume you mean it was unable to connect out via WIFI?
It didn't actually crash?

I mean that the iphone has lost the connection to the pfsense for the usual minute.
After that everything goes back to normal even on iPhones

stephenw10

How exactly are you seeing this on the iphone?

You are running a ping?

You can't connect to the webgui?

Can't pull a new IP?

I have a phone connected via wifi to pfSense here but unless I was actively testing I wouldn't notice if it got disconnected for 1min.

Even if dhcp failed completely any client should just continue to use it's existing IP until the lease expires.

Is the iphone pulling a very short dhcp lease? Like 1min?

Steve

edpbettinelli

@stephenw10
I launch an extended ping to pfsense from the iphone no problem, I do an apply on dhcp vlan test activation and the ping stops responding (between 50 and 60 lost pings)
The phone can only communicate with devices on the same vlan, no internet, no GUI,no routing to other vlan. When the iphone loses the ping client just continue to use existing ip.
Default lease time on this VLAN 7 days.

johnpoz

@stephenw10 said in Problems between iphone and dhcp?:

Is the iphone pulling a very short dhcp lease? Like 1min?

Yeah the only thing that would make sense on dhcp issue like that is lease time crazy crazy low!! I mean insane low!!

edpbettinelli

@johnpoz said in Problems between iphone and dhcp?:

Yeah the only thing that would make sense on dhcp issue like that is lease time crazy crazy low!! I mean insane low!!

I don't know the details of how iPhones manage dhcp.. Sniffing with wireshark ?

stephenw10

Try running a packet capture on pfSense for the pings during the outage.

Are the pings arriving?

Are the replies going back to the correct MAC?

edpbettinelli

@stephenw10 said in Problems between iphone and dhcp?:

Try running a packet capture on pfSense for the pings during the outage.
Are the pings arriving?
Are the replies going back to the correct MAC?

As soon as I find the time since these tests cause voice problems in the company I try to do everything and let you know. Thanks a lot for the moment.
Luca