pfSense 2.6 issues
-
@mohkhalifa
Hello. I upgraded pfSense from 2.5.2. I have pfSense running in Hyper-V machine. For some reason, now my vhdx (virtual hard disk file) keeps growing non stop.Is this a known issue or is there a setting that got changed that causes this? I tried installing on a fresh VM and restoring my config, but get same result.
When I setup the machine as fresh install, it starts out at 1.5GB image. I have ran it for 24 hours and now it's 5GB and growing.
This didn't happen with previous versions. Largest my image got was about 3GB.
Any idea what could be causing the change?
-
@firewallproblemsoops said in pfSense 2.6 issues:
When I try again/Reload/Refresh, it works, so the site itself is not down
That sounds a lot like what happens if you have IPv6 addresses but no connectivity. Is that possible? Not sure why anything would have changed going to 2.6 though.
Do you see anything blocked in the firewall logs?Steve
-
@meluvalli That's not a known issue. You should start a new thread in the Virtualisation section.
-
@stephenw10
Thanks.Found others with the same issue. :) They found a band-aid for it.
https://forum.netgate.com/topic/170992/solved-high-disk-usage-on-hyper-v/4 -
@stephenw10 said in pfSense 2.6 issues:
@firewallproblemsoops said in pfSense 2.6 issues:
When I try again/Reload/Refresh, it works, so the site itself is not down
That sounds a lot like what happens if you have IPv6 addresses but no connectivity. Is that possible? Not sure why anything would have changed going to 2.6 though.
Do you see anything blocked in the firewall logs?Steve
My Pfsense 2.7 box had, from previous configs in 2.5.2 and prior, Deny All IPv6 in System/Advanced/Network/ set to Deny. In case that was a new issue in 2.6 and 2.7, I checked that box to allow IPv6 traffic; still getting the same problem:
Tried to load wikipedia's main page, failed the first time, then reloading I could get to it.
Pinging wikipedia:
ping www.wikipedia.org
Pinging dyna.wikimedia.org [208.80.154.224] with 32 bytes of data:
Reply from 208.80.154.224: bytes=32 time=29ms TTL=53
Reply from 208.80.154.224: bytes=32 time=28ms TTL=53
Reply from 208.80.154.224: bytes=32 time=29ms TTL=53
Reply from 208.80.154.224: bytes=32 time=29ms TTL=53Ping statistics for 208.80.154.224:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 28ms, Maximum = 29ms, Average = 28msNo issues, I looked for any blocks in the firewall for 208.80.154.224, or anything even close to that, nothing at all in the firewall for that IP, let alone anything for about a minute around the time I tried to open wikipedia.org via Firefox.
-
Try running a packet capture whilst you try to open something. See where the actual failure is.
-
@stephenw10 said in pfSense 2.6 issues:
Try running a packet capture whilst you try to open something. See where the actual failure is.
Sorry for the delayed reply, I was too busy at work for awhile to mess with my home PFsense setups.
I ran a packet capture on a previous version of 2.7, when I had the same website failures, and I think I maybe captured whatever is occurring? It's hard for me to decipher, sorry. I did not see any obvious 'failure' type lines, even around the close time-frame where I had the failure to connect to a website. Also the file produced seems to be encrypted or formatted in some unknown way, I can't read the .cap file it produced now in a couple different text editors I tried.
Looking inside the Packet Capture Diagnostic in PFsense, this is the only odd line:
<timestamp> <my IPv6 IP?> > ff:ff:ff:ff:ff:ff, Unknown Ethertype (0x7373), length 121:
On the plus side, I updated the problem PFSense box to 2.7.0.a.20220328.0600 and now I cannot get the problem to repeat itself, at least last night and today, so maybe it was fixed at some point this past week? I also have IPv6 turned on now in PFsense, if the problem was partially something to do with PFsense preferring IPv6 in some instances now, or ONLY using IPv6?
If it starts happening again on 2.7x I will try to capture and just copy from the .cap display window inside PFsense, and sanitize it from my IPs before I post it.
Thank you very much for your help, and thanks if you guys quietly fixed whatever it was in the background!
-
@firewallproblemsoops said in pfSense 2.6 issues:
Also the file produced seems to be encrypted or formatted in some unknown way, I can't read the .cap file it produced now in a couple different text editors I tried.
You need to open it in Wireshark to see most useful stuff.
Steve
-
@firewallproblemsoops I had similar issue in the new version. It looks like DNS issue to me. 40-50% of the time, the webpages will not load, will say that cannot resolve or similar. If I refresh the page will load fine. I had to reinstall mine with version 2.5.2. everything is back to normal.
-
@firewallproblemsoops I did the same, ran ping -t for long time, and is not consistent, will get time out very often...
-
If it gives a resolution error then it's definitely DNS.
If it's a v6 issue then pinging something will always succeed because that's v4. You need to run ping6 and see if it tries (and fails). It should give a 'no route' or 'unreachable' error if you do not have IPv6.
Steve
-
@stephenw10 I have only IPv4 on ISP pfsense and PC. So IPv6 makes no sense for me to troubleshoot... Any other solution?
-
@adriangalbincea said in pfSense 2.6 issues:
I have only IPv4 on ISP pfsense and PC
Mmm, that's exactly what everyone who hits this thinks. Did you actually try it?
Otherwise, as I said, if it shows a resolution error it's a DNS issue. So check it can resolve against all the assigned servers. Check pfSense can also.
Steve
-
@adriangalbincea said in pfSense 2.6 issues:
ran ping -t for long time, and is not consistent, will get time out very often...
Well that says its not actually dns related, but if your having packet loss issues you could for sure have dns problems because of the packet loss.
Once you start the ping, even if was to some fqdn - if that resolved to an IP and then you later see packet loss that has nothing to do with dns. But actual packet loss..
-
@johnpoz Can well be a drop of the package too. I will let other people report this too... I will not upgrade my router just to troubleshoot again. I reverted my Windows 11 upgrade because of this to realize it was actually the pfSense upgrade, not the Windows upgrade... I spent days and forums saying nothing about this issue... What is weird though, it happened always only on the PC which is connected via cable, mobile devices had no issues... I will stay with 2.5.2 for the moment and I will not update any of my clients routers either.
-
@adriangalbincea said in pfSense 2.6 issues:
drop of the package too
Sorry but no... Have no idea what your issue was or is... But once you resolve something from dns to its IP and are running a constant ping.. .dns is out of the picture, unbound could be completely dead.. You could turn off the service.
Your saying your wireless clients all worked just fine.. So then it wasn't your isp, and how exactly was it pfsense either?
That specific interface - how exactly did you this pc connect vs your wireless clients that were having no issues, etc..
Your more than welcome to stay on version 1 if you want.. Nothing forcing you to do anything... You can continue to use windows 9x if you want as well..
-
Mmm, there is no known issue in 2.6 that presents like that. If you have found a new issue it's likely related to your setup specifically, either your hardware or config. It's unlikely to get fixed if we cannot troubleshoot it.
Steve
-
@stephenw10 said in pfSense 2.6 issues:
unlikely to get fixed if we cannot troubleshoot it.
Why would you want to do that? Just stay on version 1 of something, never move forward.. Just use what works first time until the end of time ;)
-
Well I mean that's option.
-
@stephenw10 not sure how can you sustain that is my setup at fault if I update the router firmware and the connection becomes unstable and if I restore the older version is back to normal. Really? This is how you deal with issues?
