Despite months of config, still having connection issues

[rheritier]

@JonathanLee Thanks Jonathan for the link!

I see it's from 2017, and both Pfsense and Squid have changed a lot. I'm a bit worried to try and be stuck since the options are now very different...

[NollipfSense]

@rheritier said in Despite months of config, still having connection issues:

So 1st...I have NO knowledge in network so barely can type a line of command...apology for that!

No apology needed; however, I agree with SteveTS to remain with as simple as possible until you start acquiring network knowledge by hanging out here...we all had to do that...

[stephenw10]

@rheritier said in Despite months of config, still having connection issues:

Shell Output - Ping -n 1800 8.8.4.4
sh: Ping: not found

Note that I use 1.1.1.1 and 1.0.0.1 (is it why it can't ping google?)

The ping command, like everything in FreeBSD and hence pfSense, is case sensitive. So if you're running that in pfSense you need to use ping.

It fails the second time because -n is a Windows switch. You have to use -c in pfSense. So to run that command from pfSense you would use:
ping -c 1800 8.8.4.4

However you would need to run that at the command line dircetly not using Diag > Command Prompt in the webgui. It will take 30mins to return and the page will time out before that if you try to run it through the gui.

I would add that pfSense already pings out continually and logs the results in a nice graph. See Status > Monitoring > Quality graph. You can set the IP it's monitoring to be 8.8.4.4 and you will see any packet loss.

Steve

[SteveITS]

@rheritier I meant, run that from something behind pfSense like your PC.

Packet loss is when packets of data are sent but not received. Indicative of bad wiring, bad equipment, overworked equipment, saturated connection, etc.

[JonathanLee]

@rheritier said in Despite months of config, still having connection issues:

@JonathanLee Thanks Jonathan for the link!

I see it's from 2017, and both Pfsense and Squid have changed a lot. I'm a bit worried to try and be stuck since the options are now very different...

All the configuration options are the same just better code today.

[rheritier]

Thanks so much @NollipfSense, @stephenw10, @SteveITS for your responses.

I'm learning and improving slowly but would like to first have something stable before entering into too much complexity, so I'm really to try to setup a very straight forward system, using the firewall with Squid.

Steve, thanks for the feedback, really appreciate you take the time to explain (today, another good learn about case sensitive!).
I pinged from the terminal and didn't have any loss so far (it's been 10min).

Here is what I have on the monitoring:

[SteveITS]

@rheritier Click the wrench at the top and change to Quality:

Packet loss was just a guess/starting point. You could also disable Squid temporarily, and any other packages that are installed. If you're not plugged directly in to the 2100 it could also be unstable wireless.

[rheritier]

@JonathanLee OK! I'll try that then!
I'll probably reset my netgate to start from scratch.

[JonathanLee]

@rheritier remember to simple first, do only transparent mode. Make sure you have the correct ACL for DNS, HTTP, https etc also.

Good luck.

[rheritier]

@SteveITS Here it is!
Yes, someone told me wifi was an issue and to hardwire my meshs but where they are located make hardwire impossible.
But I still have the same issues even when I only keep 1 mesh on, which is hardwired on the Netgate...

Here is the result of the quality:

[rheritier]

@JonathanLee Thanks Jonathan

I'll start with transparent mode.
On the ACL, should putting what I have below helps limiting the system blocking some websites? (example: *.com to leave all website in .com accessible)?
I need to learn more about the DNS and its configuration also.

[JonathanLee]

@rheritier I just have that set as .* for allow all. Squidguard does my blocking

Keep it simple

Regular expression based works great

[rheritier]

Thanks @JonathanLee, I like that!!
Will try it now

[JonathanLee]

@rheritier

https://docs.netgate.com/pfsense/en/latest/recipes/http-client-proxy-transparent.html
really good transparent mode guide

https://docs.netgate.com/pfsense/en/latest/packages/cache-proxy/squidguard.html
squidguard guide

[rheritier]

So I did everything so far and it seem it is a bit smoother and block less things.
But I still have for example difficult access to Amazon App. I have to deselect the wifi, let it charge a bit, reselect the Wifi and then it'll work propertly.

Here is the screenshot of my Firewall block. Anyone sees something specific??

[JonathanLee]

@rheritier do you have any IPv6 access?

[rheritier]

@JonathanLee Hi Jonathan,
I'm not sure what to think and tell you since both test seems to show different results.
Is there another way to test?

[JonathanLee]

@rheritier does your wan configuration on PfSense show anything for IPv6?

[rheritier]

@JonathanLee here is my WAN config:

[Gertjan]

@rheritier said in Despite months of config, still having connection issues:

since both test seems to show different results

The tests are different.

You visited https://test-ipv6.com/ from your PC.
You should have run the ping version IPv6 test also from your PC, like

C:\Users\Gauche>ping -6 2001:4860:4860::8888

Envoi d’une requête 'Ping'  2001:4860:4860::8888 avec 32 octets de données :
Réponse de 2001:4860:4860::8888 : temps=17 ms
Réponse de 2001:4860:4860::8888 : temps=17 ms
Réponse de 2001:4860:4860::8888 : temps=17 ms
Réponse de 2001:4860:4860::8888 : temps=17 ms

And and before running such test, why not asking your PC if it has any IPv6 connection available ? :

C:\Users\Gauche>ipconfig /all

Your pfSense IPv6 ping test (Diagnostics > Ping) shows that pfSEnse has an IPv6 connection.
Your WAN setup says it used the DHCPv6 client to obtain "IPv6".

Most probably, you should set up your LAN interface to use IPv6, like this (example ) :

and the DHCPv6 LAN server :

also :

This WAN IPv6 :

is also listed here : Status > Interfaces under the WAN interface.