pfSense 2.6 issues

KpuCko

What's in the file 2.5.2 then?

I'm not aware of anything than would have changed there but you might have something obscure set.

Steve

stephenw10

Did you set that state table size or just have a lot of ram?

KpuCko

@stephenw10 said in pfSense 2.6 issues:

Did you set that state table size or just have a lot of ram?

I have 16g of ram

KpuCko

So guys, how to make it more official?
I mean, look at the big post I have created, I have few issues mentioned in there.

Do I need to file a bug report, or as I'm a free user, someone else has to do that?

stephenw10

Anyone can open a bug report: https://redmine.pfsense.org/

We need clear steps to recreate it though and I don't think we have that yet. I've updated numerous devices from 2.5.2 to 2.6 and never hit this and I don't see and other reports of it. There must be something unusual in your ruleset that it hitting an issue.

Can we see your ruleset? (/tmp/rules.debug)

If not can you generate another ruleset that still hits this?

Are you using any obscure features?

Steve

KpuCko

@stephenw10 I have sent to you the needed information via PM

FirewallProblemsOops

I posted in the Limiter thread, but that thread has taken on a life of its own, and is rightly focused only on the limiter issue.

There seems to be a problem in 2.6 and the 2.7 developmental versions, where I only connect to addresses 50% of the time.

I changed nothing in my configuration from 2.5.2 to 2.6 / 2.7(trying these currently, same problem). Pretty straightforward, NO connection limiters, simple ruleset for the Firewall, using DNS Forwarder to OpenDNS.

My Firewall has the pfB_BinaryDefense and pfB_EmergingThreatsDShield lists ( from https://linuxincluded.com/using-pfblockerng-on-pfsense/ ) but obviously basic sites like duckduckgo.com aren't in there, yet my computers on the 2.6/2.7 PFSense box fail around 50% of the time to such basic commercial websites.

I have the Bogon network rule block, WAN to PFsense block, WAN telnet to Pfsense block rules, and that's pretty much it. LAN side, the anti-lockout rule, and a basic block DNS attempts that aren't to PFsense(and thus forwarded to OpenDNS) rule.

Another 2.5.2 box running with the same config, in the same house, with the same ISP obviously, has no issues at all.

These configs have worked through multiple version of PFSense up until 2.6, and the issue persists in the 2.7 developmental versions.

Thanks, any help would be appreciated.

stephenw10

How does it fail? What error do you see?

Are you able to resolve the sites every time?

Are you able to connect in other ways such as ping them reliably?

Steve

FirewallProblemsOops

@stephenw10 said in pfSense 2.6 issues:

How does it fail? What error do you see?

Are you able to resolve the sites every time?

Are you able to connect in other ways such as ping them reliably?

Steve

Using Firefox browser for example, getting this error message:

"Hmm. We’re having trouble finding that site.

We can’t connect to the server at www.tyrrellscrisps.co.uk.

If that address is correct, here are three other things you can try:

Try again later.
Check your network connection.
If you are connected but behind a firewall, check that Firefox has permission to access the Web. "

When I try again/Reload/Refresh, it works, so the site itself is not down. This happens for any major site seemingly at random.

Also noticeable inside services such as Steam, half the page won't load, etc. while other portions load fine. Reloading resolves it usually.

I do not have any Captive Portal or Limiters active, this isn't even through WiFi via FreeRadius3 account, just ethernet cables connected to the PFsense box. Windows 10 machine, a Mint Linux machine, both have the same issue, around 50% connections fail to major websites, but can be reloaded to connect.

And as I said, the configuration has not changed since 2.5.2, where this was working fine, now 2.6 and whatever the current 2.7 snapshot is, both have the DNS failure/blocking issue.

EDIT I am able to ping most sites, not noticing any failures via PING, except to duckduckgo.com ironically which seems to block ping by default. Disclaimer I did not do an extensive test of pinging 300+ sites or anything, a random 20 or so of major websites responded 4 out of 4 pings.

meluvalli

@mohkhalifa
Hello. I upgraded pfSense from 2.5.2. I have pfSense running in Hyper-V machine. For some reason, now my vhdx (virtual hard disk file) keeps growing non stop.

Is this a known issue or is there a setting that got changed that causes this? I tried installing on a fresh VM and restoring my config, but get same result.

When I setup the machine as fresh install, it starts out at 1.5GB image. I have ran it for 24 hours and now it's 5GB and growing.

This didn't happen with previous versions. Largest my image got was about 3GB.

Any idea what could be causing the change?

stephenw10

@firewallproblemsoops said in pfSense 2.6 issues:

When I try again/Reload/Refresh, it works, so the site itself is not down

That sounds a lot like what happens if you have IPv6 addresses but no connectivity. Is that possible? Not sure why anything would have changed going to 2.6 though.
Do you see anything blocked in the firewall logs?

Steve

stephenw10

@meluvalli That's not a known issue. You should start a new thread in the Virtualisation section.

meluvalli

@stephenw10
Thanks.

Found others with the same issue. :) They found a band-aid for it.
https://forum.netgate.com/topic/170992/solved-high-disk-usage-on-hyper-v/4

FirewallProblemsOops

@stephenw10 said in pfSense 2.6 issues:

@firewallproblemsoops said in pfSense 2.6 issues:

When I try again/Reload/Refresh, it works, so the site itself is not down

That sounds a lot like what happens if you have IPv6 addresses but no connectivity. Is that possible? Not sure why anything would have changed going to 2.6 though.
Do you see anything blocked in the firewall logs?

Steve

My Pfsense 2.7 box had, from previous configs in 2.5.2 and prior, Deny All IPv6 in System/Advanced/Network/ set to Deny. In case that was a new issue in 2.6 and 2.7, I checked that box to allow IPv6 traffic; still getting the same problem:

Tried to load wikipedia's main page, failed the first time, then reloading I could get to it.

Pinging wikipedia:

ping www.wikipedia.org

Pinging dyna.wikimedia.org [208.80.154.224] with 32 bytes of data:
Reply from 208.80.154.224: bytes=32 time=29ms TTL=53
Reply from 208.80.154.224: bytes=32 time=28ms TTL=53
Reply from 208.80.154.224: bytes=32 time=29ms TTL=53
Reply from 208.80.154.224: bytes=32 time=29ms TTL=53

Ping statistics for 208.80.154.224:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 28ms, Maximum = 29ms, Average = 28ms

No issues, I looked for any blocks in the firewall for 208.80.154.224, or anything even close to that, nothing at all in the firewall for that IP, let alone anything for about a minute around the time I tried to open wikipedia.org via Firefox.

stephenw10

Try running a packet capture whilst you try to open something. See where the actual failure is.

FirewallProblemsOops

@stephenw10 said in pfSense 2.6 issues:

Try running a packet capture whilst you try to open something. See where the actual failure is.

Sorry for the delayed reply, I was too busy at work for awhile to mess with my home PFsense setups.

I ran a packet capture on a previous version of 2.7, when I had the same website failures, and I think I maybe captured whatever is occurring? It's hard for me to decipher, sorry. I did not see any obvious 'failure' type lines, even around the close time-frame where I had the failure to connect to a website. Also the file produced seems to be encrypted or formatted in some unknown way, I can't read the .cap file it produced now in a couple different text editors I tried.

Looking inside the Packet Capture Diagnostic in PFsense, this is the only odd line:

<timestamp> <my IPv6 IP?> > ff:ff:ff:ff:ff:ff, Unknown Ethertype (0x7373), length 121:

On the plus side, I updated the problem PFSense box to 2.7.0.a.20220328.0600 and now I cannot get the problem to repeat itself, at least last night and today, so maybe it was fixed at some point this past week? I also have IPv6 turned on now in PFsense, if the problem was partially something to do with PFsense preferring IPv6 in some instances now, or ONLY using IPv6?

If it starts happening again on 2.7x I will try to capture and just copy from the .cap display window inside PFsense, and sanitize it from my IPs before I post it.

Thank you very much for your help, and thanks if you guys quietly fixed whatever it was in the background!

stephenw10

@firewallproblemsoops said in pfSense 2.6 issues:

Also the file produced seems to be encrypted or formatted in some unknown way, I can't read the .cap file it produced now in a couple different text editors I tried.

You need to open it in Wireshark to see most useful stuff.

Steve

adriangalbincea

@firewallproblemsoops I had similar issue in the new version. It looks like DNS issue to me. 40-50% of the time, the webpages will not load, will say that cannot resolve or similar. If I refresh the page will load fine. I had to reinstall mine with version 2.5.2. everything is back to normal.

adriangalbincea

@firewallproblemsoops I did the same, ran ping -t for long time, and is not consistent, will get time out very often...

stephenw10

If it gives a resolution error then it's definitely DNS.

If it's a v6 issue then pinging something will always succeed because that's v4. You need to run ping6 and see if it tries (and fails). It should give a 'no route' or 'unreachable' error if you do not have IPv6.

Steve