Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    pfSense Sporadic unable to get to internet.

    Scheduled Pinned Locked Moved
    General pfSense Questions
    5
    16
    968
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • P
      panzerscope @the other
      last edited by

      @the-other said in pfSense Sporadic unable to get to internet.:

      @panzerscope
      Hey there,
      excuse my poor input for I am definitly no pfsense pro...
      What struck me by looking at your pfsense log:

      • unbound as DNS resolver seems to stop
      • at the same time you have DNS resolver AND (??) forwarder running...why both?
      • might be a known unbound issue, when DHCP registration is active...unbound then stops and starts again everytime a new client tries to get its IP?

      Just a guess...

      Thanks for the input! Well I have just checked at DNS Forwarding is not enabled, I only have the DNS Resolver enabled.

      b63b306c-6c21-47dd-8b6b-ff33d12f44ae-image.png

      Fair point about the unbound DNS issues, though unsure what I would do to test/remedy the issue. I would assume that it could be related to pfblockerNG and its DNS based filtering via DNSBL. Though not sure.

      the otherT 1 Reply Last reply Reply Quote 0
      • the otherT
        the other @panzerscope
        last edited by

        @panzerscope
        Hey,
        is the option dhcp registration under Services > DNS resolver active? Might want to deactivate that and give it a try.

        Yeah, I also assume that it is a DNS related problem since your log shows an issue with resolving the needed address for sending e-mail...

        I get the same error once in a while: unbound seems to stop, DNS not working, most of the time it starts again by itself, once in a while it needs a manual kick in the butt to start again...and so far I could not solve that...happens about twice a month.

        the other

        pure amateur home user, no business or professional background
        please excuse poor english skills and typpoz :)

        P 1 Reply Last reply Reply Quote 1
        • P
          panzerscope @the other
          last edited by

          @the-other

          Thanks,I have just checked and DNS registration is disabled. This is the DNS Resolver page currently.

          268e2b04-1bed-482f-b8ff-e83efb1c2797-image.png

          1 Reply Last reply Reply Quote 0
          • bmeeksB
            bmeeks
            last edited by bmeeks

            I see a number of issues from the entries in the log snippet you posted.

            First, you have the DNS Forwarder (dnsmasq) being monitored by the Service Watchdog package. I see multiple times in your logs where Service Watchdog thinks the DNS Forwarder is "down" and restarts it. Because the Forwarder and Resolver both want to run on the same port, you have problems. That leads to DNS failures. The DNS Resolver on pfSense is unbound. The DNS Forwarder is dnsmasq.

            Second big issue is that you have Snort configured in the Service Watchdog package. I am the Snort package developer/maintainer, and I have posted here on the pfSense forums over and over that a user should NEVER configure Service Watchdog to monitor Snort. Service Watchdog does not understand how Snort works and will attempt to restart it when unnecessary. That can eventually lead to many duplicate Snort processes running on the same interface.

            Finally, I see a number of netmap device errors related to running Snort in Inline IPS Mode. It might be due to duplicate processes created by the Service Watchdog package not understanding how Snort works, or it might be due to your particular NIC variant not being 100% netmap compliant.

            johnpozJ P 2 Replies Last reply Reply Quote 1
            • johnpozJ
              johnpoz LAYER 8 Global Moderator @bmeeks
              last edited by johnpoz

              @bmeeks said in pfSense Sporadic unable to get to internet.:

              Snort configured in the Service Watchdog package

              But he doesn't even show that as a running service, he has Suricata listed.. So trying to run both?, switched to it vs snort, but left short in the watchdog?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.03 | Lab VMs 2.7.2, 24.03

              bmeeksB 1 Reply Last reply Reply Quote 1
              • bmeeksB
                bmeeks @johnpoz
                last edited by bmeeks

                @johnpoz said in pfSense Sporadic unable to get to internet.:

                @bmeeks said in pfSense Sporadic unable to get to internet.:

                Snort configured in the Service Watchdog package

                But he doesn't even show that as a running service, he has Suricata listed.. So trying to run both?, switched to it vs snort, but left short in the watchdog?

                Yeah, I'm thinking Service Watchdog has some improper entries.

                I just immediately looked into the posted log attachment and did not examine all the installed packages. But yes, you are correct. He has Suricata installed now, but Service Watchdog is trying to start Snort.

                1 Reply Last reply Reply Quote 1
                • P
                  panzerscope @bmeeks
                  last edited by

                  @bmeeks
                  @johnpoz

                  Thanks very much for your comments and help. So it is true that I switched from Snort to Suricata, thus must have ended up being a left over entry in the Service Watchdog.

                  I have removed Snort as well as the DNS Forwarder from the Service Watchdog. Currently my watchdog list looks like the following.

                  bbfe72ee-7c24-48b4-935e-1913ea029201-image.png

                  Does this list look appropriate, will retaining the unbound DNS Resolver in the list cause any issues ? Once I have this cleared up I will reboot the pfsense box and see if I get these issues again further down the line.

                  bmeeksB 1 Reply Last reply Reply Quote 0
                  • bmeeksB
                    bmeeks @panzerscope
                    last edited by

                    @panzerscope said in pfSense Sporadic unable to get to internet.:

                    @bmeeks
                    @johnpoz

                    Thanks very much for your comments and help. So it is true that I switched from Snort to Suricata, thus must have ended up being a left over entry in the Service Watchdog.

                    I have removed Snort as well as the DNS Forwarder from the Service Watchdog. Currently my watchdog list looks like the following.

                    bbfe72ee-7c24-48b4-935e-1913ea029201-image.png

                    Does this list look appropriate, will retaining the unbound DNS Resolver in the list cause any issues ? Once I have this cleared up I will reboot the pfsense box and see if I get these issues again further down the line.

                    Personally, there is really no need to run the Service Watchdog package. At best, if you have services randomly stopping, it is a band aid. You need to identify why the services are randomly stopping and fix that root cause. Service Watchdog is not a package I would consider installing.

                    unbound makes a great resolver for pfSense, but it begins to get a bit strained when you use a package like pfBlockerNG-devel to create and maintain large DNS blacklists (via the DNSBL addon, for example).

                    P 1 Reply Last reply Reply Quote 2
                    • P
                      panzerscope @bmeeks
                      last edited by

                      @bmeeks said in pfSense Sporadic unable to get to internet.:

                      @panzerscope said in pfSense Sporadic unable to get to internet.:

                      @bmeeks
                      @johnpoz

                      Thanks very much for your comments and help. So it is true that I switched from Snort to Suricata, thus must have ended up being a left over entry in the Service Watchdog.

                      I have removed Snort as well as the DNS Forwarder from the Service Watchdog. Currently my watchdog list looks like the following.

                      bbfe72ee-7c24-48b4-935e-1913ea029201-image.png

                      Does this list look appropriate, will retaining the unbound DNS Resolver in the list cause any issues ? Once I have this cleared up I will reboot the pfsense box and see if I get these issues again further down the line.

                      Personally, there is really no need to run the Service Watchdog package. At best, if you have services randomly stopping, it is a band aid. You need to identify why the services are randomly stopping and fix that root cause. Service Watchdog is not a package I would consider installing.

                      unbound makes a great resolver for pfSense, but it begins to get a bit strained when you use a package like pfBlockerNG-devel to create and maintain large DNS blacklists (via the DNSBL addon, for example).

                      That is a fair point to be honest, best to fix the problem over the service continuously restarting the service. With that in mind, I have gone ahead and removed Service Watchdog altogether. Stops it from being a factor after all.

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • P
                        panzerscope
                        last edited by

                        I also meant to ask, specifically regarding this screenshot where it makes references to netmap. Is this normal ? I just cannot recall if I got this before. I know I did solve all my netmap issues when switching to the Intel I350 -T4 NIC. A discussion previously had here: https://forum.netgate.com/topic/171570/editing-loader-conf

                        Pfsense Netmap Message.jpg

                        Thanks again!

                        bmeeksB 1 Reply Last reply Reply Quote 0
                        • johnpozJ
                          johnpoz LAYER 8 Global Moderator @panzerscope
                          last edited by

                          @panzerscope why would you have pcscd in watchdog - are you actually using it? Its got a memory leak, there are multiple threads about it. And it was set to not run on default I do believe a update or so back, etc.

                          I don't even have the service watchdog package installed..

                          An intelligent man is sometimes forced to be drunk to spend time with his fools
                          If you get confused: Listen to the Music Play
                          Please don't Chat/PM me for help, unless mod related
                          SG-4860 24.03 | Lab VMs 2.7.2, 24.03

                          1 Reply Last reply Reply Quote 0
                          • bmeeksB
                            bmeeks @panzerscope
                            last edited by

                            @panzerscope said in pfSense Sporadic unable to get to internet.:

                            I also meant to ask, specifically regarding this screenshot where it makes references to netmap. Is this normal ? I just cannot recall if I got this before. I know I did solve all my netmap issues when switching to the Intel I350 -T4 NIC. A discussion previously had here: https://forum.netgate.com/topic/171570/editing-loader-conf

                            Pfsense Netmap Message.jpg

                            Thanks again!

                            Yes, those are purely informational startup messages logged by the netmap device. They show that your NIC is providing 4 TX and 4 RX netmap queues (or rings).

                            The messages I saw in your logs that indicated problems were the ones that said something along the lines of "... netmap_reinint ...". I don't recall that exact wording off the top of my head. But those messages in your previous system log showing netmap issues indicate that multiple threads were stepping on each other's netmap buffer (or ring) areas.

                            1 Reply Last reply Reply Quote 0
                            • stephenw10S
                              stephenw10 Netgate Administrator
                              last edited by

                              Yeah, you do not want pcscd running at all. It's disabled by default in 2.6.
                              https://redmine.pfsense.org/issues/11933

                              And, yeah, you probably don't need/want the services watchdog running at all. You should have a specific reason for enabling that for any service.

                              Steve

                              1 Reply Last reply Reply Quote 0
                              • P
                                panzerscope
                                last edited by

                                Thanks all for your help. I just wanted to come back and things seem to now be resolved due to the above steps. Fingers crossed it stays that way. Hopefully some other newb will find this useful in the future.

                                1 Reply Last reply Reply Quote 1
                                • First post
                                  Last post