Netgate 7100 needing reboot to being internet back
-
Hi All.
I have 2 different sites where the netgate just randomly stops providing internet to all subnets and vlans.
The internet connection is still live, and the device is still reachable, but a rebooted is needed to bring all the internet back.
Whilst i know that's not a lot of information, I don't really have much more to provide as I'm not sure where to look as to what might be the issue.
100 room hotel, 4 or 5 subnets, pretty standard firewall rules, not a crazy network.
-
@wifi-will You could provide log when you reboot the device Status > System logs > System > General.
Do you have access to the GUI when the device is still reachable?
-
@nollipfsense thanks for your reply.
I had a look at the logs but they are out of range now as it was a few days ago the last time.
Yeah, we still have access to the GUI when the customers report all internet is off. We perform a standard reboot and it comes back on.
I do notice this which is curious 22.01-RELEASE (amd64)
built on Mon Feb 07 16:37:59 UTC 2022
FreeBSD 12.3-STABLEUnable to check for updates
Unable to check for updates seems concerning
-
@wifi-will Have you confirmed that it's not your ISP...it sounds more like your ISP could have been down which would trigger WAN interface been down on the logs.
-
@nollipfsense yep, confirmed not ISP, still able to access GUI remotely. ISP confirmed uptime aswell
-
@wifi-will said in Netgate 7100 needing reboot to being internet back:
Unable to check for updates
Probably unrelated, I'd guess. Could mean DNS on pfSense itself isn't working, or see https://docs.netgate.com/pfsense/en/latest/troubleshooting/upgrades.html#upgrade-not-offered-library-errors. 22.01 should be offering 22.05.
When the outage happens can you ping out with an internal interface as the source?
-
@wifi-will Check Status->Gateways before rebooting next time. If it is offline look at setting the Monitoring IP on the firewall to something that responds 24x7.
-
@rcoleman-netgate if the WAN is accessible remotely it’s not a WAN gateway problem…? :)
Might be interesting to NAT a port to LAN:443 and see if that doesn’t work.
-
@steveits said in Netgate 7100 needing reboot to being internet back:
if the WAN is accessible remotely it’s not a WAN gateway problem…? :)
you're right, I missed that.
-
It could be a bad default gateway issue though. If the default IPv4 gateway in System > Routing > Gateways is still set to auto set it to the WAN gateway specifically.
If you have more than one gateway on the system and the WAN has a brief outage pfSense will switch the default to whatever else is available and that can be something incorrect. Rebooting resets that back to the first entry, usually WAN.Steve
-
@stephenw10 we only have 1 gateway. But there is a /29 assigned to it as well. Not sure how they would relate to that, however. Manual outbound NAT is in place and uses NO NAT to send out the right public IP.
-
@wifi-will I would change the gateway from a {blank} monitoring IP to something that replies to public pings just to play it safe. Google DNS is a good choice as it always replies, does so quickly, and doesn't block pinging IPs.
-
@rcoleman-netgate thanks Ryan. Ill give that a try. I have also upgrade to 22.05 from 22.01. We had an issue whereby the guest vlan wasn't passing traffic again. I changed the PFSense captive portal idle timeout to 120 mins from 30 mins and saw traffic again. Could these events somehow be related? and is 22.05 pretty stable ?
-
@wifi-will 22.05 is quite stable but there are known captive portal issues that are resolved in the pending 23.01 release -- hopefully we will be making that available soon but a timeline is not set yet.
The issues with CP have to do with UDP traffic so if that is what you are experiencing I would get the last config you have from 22.01 and back it up, open a ticket at the URL in my signature for the 22.01 firmware, and roll back.
You should not use the config from 22.05 on older releases.
-
@rcoleman-netgate Ok well i might roll it back then until 23.1 is out of BETA
-
Yes, make sure WANGW is set as default and not auto.
