pfSense 2.6 issues
-
@stephenw10 said in pfSense 2.6 issues:
@firewallproblemsoops said in pfSense 2.6 issues:
When I try again/Reload/Refresh, it works, so the site itself is not down
That sounds a lot like what happens if you have IPv6 addresses but no connectivity. Is that possible? Not sure why anything would have changed going to 2.6 though.
Do you see anything blocked in the firewall logs?Steve
My Pfsense 2.7 box had, from previous configs in 2.5.2 and prior, Deny All IPv6 in System/Advanced/Network/ set to Deny. In case that was a new issue in 2.6 and 2.7, I checked that box to allow IPv6 traffic; still getting the same problem:
Tried to load wikipedia's main page, failed the first time, then reloading I could get to it.
Pinging wikipedia:
ping www.wikipedia.org
Pinging dyna.wikimedia.org [208.80.154.224] with 32 bytes of data:
Reply from 208.80.154.224: bytes=32 time=29ms TTL=53
Reply from 208.80.154.224: bytes=32 time=28ms TTL=53
Reply from 208.80.154.224: bytes=32 time=29ms TTL=53
Reply from 208.80.154.224: bytes=32 time=29ms TTL=53Ping statistics for 208.80.154.224:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 28ms, Maximum = 29ms, Average = 28msNo issues, I looked for any blocks in the firewall for 208.80.154.224, or anything even close to that, nothing at all in the firewall for that IP, let alone anything for about a minute around the time I tried to open wikipedia.org via Firefox.
-
Try running a packet capture whilst you try to open something. See where the actual failure is.
-
@stephenw10 said in pfSense 2.6 issues:
Try running a packet capture whilst you try to open something. See where the actual failure is.
Sorry for the delayed reply, I was too busy at work for awhile to mess with my home PFsense setups.
I ran a packet capture on a previous version of 2.7, when I had the same website failures, and I think I maybe captured whatever is occurring? It's hard for me to decipher, sorry. I did not see any obvious 'failure' type lines, even around the close time-frame where I had the failure to connect to a website. Also the file produced seems to be encrypted or formatted in some unknown way, I can't read the .cap file it produced now in a couple different text editors I tried.
Looking inside the Packet Capture Diagnostic in PFsense, this is the only odd line:
<timestamp> <my IPv6 IP?> > ff:ff:ff:ff:ff:ff, Unknown Ethertype (0x7373), length 121:
On the plus side, I updated the problem PFSense box to 2.7.0.a.20220328.0600 and now I cannot get the problem to repeat itself, at least last night and today, so maybe it was fixed at some point this past week? I also have IPv6 turned on now in PFsense, if the problem was partially something to do with PFsense preferring IPv6 in some instances now, or ONLY using IPv6?
If it starts happening again on 2.7x I will try to capture and just copy from the .cap display window inside PFsense, and sanitize it from my IPs before I post it.
Thank you very much for your help, and thanks if you guys quietly fixed whatever it was in the background!
-
@firewallproblemsoops said in pfSense 2.6 issues:
Also the file produced seems to be encrypted or formatted in some unknown way, I can't read the .cap file it produced now in a couple different text editors I tried.
You need to open it in Wireshark to see most useful stuff.
Steve
-
@firewallproblemsoops I had similar issue in the new version. It looks like DNS issue to me. 40-50% of the time, the webpages will not load, will say that cannot resolve or similar. If I refresh the page will load fine. I had to reinstall mine with version 2.5.2. everything is back to normal.
-
@firewallproblemsoops I did the same, ran ping -t for long time, and is not consistent, will get time out very often...
-
If it gives a resolution error then it's definitely DNS.
If it's a v6 issue then pinging something will always succeed because that's v4. You need to run ping6 and see if it tries (and fails). It should give a 'no route' or 'unreachable' error if you do not have IPv6.
Steve
-
@stephenw10 I have only IPv4 on ISP pfsense and PC. So IPv6 makes no sense for me to troubleshoot... Any other solution?
-
@adriangalbincea said in pfSense 2.6 issues:
I have only IPv4 on ISP pfsense and PC
Mmm, that's exactly what everyone who hits this thinks. Did you actually try it?
Otherwise, as I said, if it shows a resolution error it's a DNS issue. So check it can resolve against all the assigned servers. Check pfSense can also.
Steve
-
@adriangalbincea said in pfSense 2.6 issues:
ran ping -t for long time, and is not consistent, will get time out very often...
Well that says its not actually dns related, but if your having packet loss issues you could for sure have dns problems because of the packet loss.
Once you start the ping, even if was to some fqdn - if that resolved to an IP and then you later see packet loss that has nothing to do with dns. But actual packet loss..
-
@johnpoz Can well be a drop of the package too. I will let other people report this too... I will not upgrade my router just to troubleshoot again. I reverted my Windows 11 upgrade because of this to realize it was actually the pfSense upgrade, not the Windows upgrade... I spent days and forums saying nothing about this issue... What is weird though, it happened always only on the PC which is connected via cable, mobile devices had no issues... I will stay with 2.5.2 for the moment and I will not update any of my clients routers either.
-
@adriangalbincea said in pfSense 2.6 issues:
drop of the package too
Sorry but no... Have no idea what your issue was or is... But once you resolve something from dns to its IP and are running a constant ping.. .dns is out of the picture, unbound could be completely dead.. You could turn off the service.
Your saying your wireless clients all worked just fine.. So then it wasn't your isp, and how exactly was it pfsense either?
That specific interface - how exactly did you this pc connect vs your wireless clients that were having no issues, etc..
Your more than welcome to stay on version 1 if you want.. Nothing forcing you to do anything... You can continue to use windows 9x if you want as well..
-
Mmm, there is no known issue in 2.6 that presents like that. If you have found a new issue it's likely related to your setup specifically, either your hardware or config. It's unlikely to get fixed if we cannot troubleshoot it.
Steve
-
@stephenw10 said in pfSense 2.6 issues:
unlikely to get fixed if we cannot troubleshoot it.
Why would you want to do that? Just stay on version 1 of something, never move forward.. Just use what works first time until the end of time ;)
-
Well I mean that's option.
-
@stephenw10 not sure how can you sustain that is my setup at fault if I update the router firmware and the connection becomes unstable and if I restore the older version is back to normal. Really? This is how you deal with issues?
-
@adriangalbincea said in pfSense 2.6 issues:
can you sustain that is my setup at fault
Because if not then the forum would be on fire with everyone on the planet that upgraded to 2.6 screaming it doesn't work.
So clearly it is something related to you setup in some fashion that is unique enough that others are not screaming about the same issue..
That is how.. What are you running pfsense on? Hardware, VM? There quite a bit of chatter about users having issues with hyper-v, etc. What interface was this pc connected too, some usb interface, an port from a multiple port nic? A intel nic, a realtek nic?
We have absolutely zero actual info about your problem... You say websites don't load 50 % of the time, but only this 1 pc - not any of yoru wireless clients, or othe wired client?? But you say it looses ping.. 50% loss? 5% loss? Pings once started have zero to do with dns, etc. etc..
-
@adriangalbincea said in pfSense 2.6 issues:
not sure how can you sustain that is my setup at fault
Sorry, I'm not assigning blame here. If your config worked fine in 2.5.2 it should work fine in 2.6.
I'm just saying that the fact most users are not seeing issues like that indicates there is something in your config or hardware that is unusual.
To solve this we need to first pin down how this is failing then try to replicate that locally. But we need you to give us some details so we can attempt that and that might mean you need to be running 2.6.So, yeah, what hardware are you running? Anything unusual?
What config are you running? Again anything unusual?
Steve
-
This post is deleted! -
Just wanted to post here that I am having the exact same issue as @KpuCko . I tested all the hardware every way I can, and it all seems to be in good working order. Previous updates have been performed without any issue.
Hardware:
-HP DL320e G8 v2
-Intel Core i3 4150
-4GB ECC Unbuffered Memory
-2x 40GB Intel SATA SSDs in ZFS Mirror
-Only network card in use is an HP NC365T which is Intel BasedConfig Overview: 1x Passive LAG (bridged with LAN), OpenVPN, HAproxy, 1x LAN, 1x LAN, Minimal firewall rules
Probably going to end up reinstalling. I doubt I will receive a response here, but if you do happen to see this within the next few days and have any suggestions on another fix, please let me know!
