Despite months of config, still having connection issues

JonathanLee

@rheritier said in Despite months of config, still having connection issues:

@JonathanLee Thanks Jonathan for the link!

I see it's from 2017, and both Pfsense and Squid have changed a lot. I'm a bit worried to try and be stuck since the options are now very different...

All the configuration options are the same just better code today.

rheritier

Thanks so much @NollipfSense, @stephenw10, @SteveITS for your responses.

I'm learning and improving slowly but would like to first have something stable before entering into too much complexity, so I'm really to try to setup a very straight forward system, using the firewall with Squid.

Steve, thanks for the feedback, really appreciate you take the time to explain (today, another good learn about case sensitive!).
I pinged from the terminal and didn't have any loss so far (it's been 10min).

Here is what I have on the monitoring:

Screen Shot 2023-09-22 at 9.54.22 AM.png

SteveITS

@rheritier Click the wrench at the top and change to Quality:

Packet loss was just a guess/starting point. You could also disable Squid temporarily, and any other packages that are installed. If you're not plugged directly in to the 2100 it could also be unstable wireless.

rheritier

@JonathanLee OK! I'll try that then!
I'll probably reset my netgate to start from scratch.

JonathanLee

@rheritier remember to simple first, do only transparent mode. Make sure you have the correct ACL for DNS, HTTP, https etc also.

Good luck.

rheritier

@SteveITS Here it is!
Yes, someone told me wifi was an issue and to hardwire my meshs but where they are located make hardwire impossible.
But I still have the same issues even when I only keep 1 mesh on, which is hardwired on the Netgate...

Here is the result of the quality:

Screen Shot 2023-09-22 at 10.18.31 AM.png

rheritier

@JonathanLee Thanks Jonathan

I'll start with transparent mode.
On the ACL, should putting what I have below helps limiting the system blocking some websites? (example: *.com to leave all website in .com accessible)?
I need to learn more about the DNS and its configuration also.

Screen Shot 2023-09-22 at 10.22.58 AM.png

JonathanLee

@rheritier I just have that set as .* for allow all. Squidguard does my blocking

Keep it simple

Regular expression based works great

rheritier

Thanks @JonathanLee, I like that!!
Will try it now

JonathanLee

@rheritier

https://docs.netgate.com/pfsense/en/latest/recipes/http-client-proxy-transparent.html
really good transparent mode guide

https://docs.netgate.com/pfsense/en/latest/packages/cache-proxy/squidguard.html
squidguard guide

rheritier

So I did everything so far and it seem it is a bit smoother and block less things.
But I still have for example difficult access to Amazon App. I have to deselect the wifi, let it charge a bit, reselect the Wifi and then it'll work propertly.

Here is the screenshot of my Firewall block. Anyone sees something specific??

Screenshot 2023-09-22 134602.png

JonathanLee

@rheritier do you have any IPv6 access?

rheritier

@JonathanLee Hi Jonathan,
I'm not sure what to think and tell you since both test seems to show different results.
Is there another way to test?

Screen Shot 2023-09-24 at 10.12.15 AM.png

Screen Shot 2023-09-24 at 10.12.31 AM.png

JonathanLee

@rheritier does your wan configuration on PfSense show anything for IPv6?

rheritier

@JonathanLee here is my WAN config:
Screen Shot 2023-09-24 at 10.45.02 PM.png

Gertjan

@rheritier said in Despite months of config, still having connection issues:

since both test seems to show different results

The tests are different.

You visited https://test-ipv6.com/ from your PC.
You should have run the ping version IPv6 test also from your PC, like

C:\Users\Gauche>ping -6 2001:4860:4860::8888

Envoi d’une requête 'Ping'  2001:4860:4860::8888 avec 32 octets de données :
Réponse de 2001:4860:4860::8888 : temps=17 ms
Réponse de 2001:4860:4860::8888 : temps=17 ms
Réponse de 2001:4860:4860::8888 : temps=17 ms
Réponse de 2001:4860:4860::8888 : temps=17 ms

And and before running such test, why not asking your PC if it has any IPv6 connection available ? :

C:\Users\Gauche>ipconfig /all

Your pfSense IPv6 ping test (Diagnostics > Ping) shows that pfSEnse has an IPv6 connection.
Your WAN setup says it used the DHCPv6 client to obtain "IPv6".

Most probably, you should set up your LAN interface to use IPv6, like this (example ) :

and the DHCPv6 LAN server :

also :

This WAN IPv6 :

is also listed here : Status > Interfaces under the WAN interface.

rheritier

Hi @Gertjan ! Thanks!
So I did the following:
Ipconfig /all (on Mac, it seems to be /sbins/ifconfig) and here is the result (I hided some info):

lo0: flags=8049<UP,LOOPBACK,RUNNING,MULTICAST> mtu 16384
options=1203<RXCSUM,TXCSUM,TXSTATUS,SW_TIMESTAMP>
inet 127.0.0.1 netmask 0xff000000
inet6 ::1 prefixlen 128
inet6 fe80::1%lo0 prefixlen 64 scopeid 0x1
nd6 options=201<PERFORMNUD,DAD>
gif0: flags=8010<POINTOPOINT,MULTICAST> mtu 1280
stf0: flags=0<> mtu 1280
en0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=50b<RXCSUM,TXCSUM,VLAN_HWTAGGING,AV,CHANNEL_IO>
ether a8:XXXX:22:00:f6
nd6 options=201<PERFORMNUD,DAD>
media: autoselect (none)
status: inactive
en1: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=400<CHANNEL_IO>
ether 20:XXXX:cc:ba:15
inet6 fe80::XXXX:9648:76df:976d%en1 prefixlen 64 secured scopeid 0x5
inet 192.168.1.110 netmask 0xffffff00 broadcast 192.168.1.255
inet6 fd2b:XXXX:5617:48b5:86e:6bad:9d1b:b18c prefixlen 64 autoconf secured
inet6 fd2b:XXXX:5617:48b5:a56c:fca1:5cfb:5727 prefixlen 64 autoconf temporary
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active
en2: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
options=460<TSO4,TSO6,CHANNEL_IO>
ether 82:XXXX:fe:0c:80
media: autoselect <full-duplex>
status: inactive
fw0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 4078
lladdr a8:XXXX:ff:fe:67:f8:32
nd6 options=201<PERFORMNUD,DAD>
media: autoselect <full-duplex>
status: inactive
bridge0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1500
options=63<RXCSUM,TXCSUM,TSO4,TSO6>
ether 82:XXXX:fe:0c:80
Configuration:
id 0:0:0:0:0:0 priority 0 hellotime 0 fwddelay 0
maxage 0 holdcnt 0 proto stp maxaddr 100 timeout 1200
root id 0:0:0:0:0:0 priority 0 ifcost 0 port 0
ipfilter disabled flags 0x0
member: en2 flags=3<LEARNING,DISCOVER>
ifmaxaddr 0 port 6 priority 0 path cost 0
nd6 options=201<PERFORMNUD,DAD>
media: <unknown type>
status: inactive
p2p0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 2304
options=400<CHANNEL_IO>
ether 02:XXXX:cc:ba:15
media: autoselect
status: inactive
awdl0: flags=8943<UP,BROADCAST,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1484
options=400<CHANNEL_IO>
ether 5e:XXXX:3f:da:96
inet6 fe80::XXXX:21ff:fe3f:da96%awdl0 prefixlen 64 scopeid 0xa
nd6 options=201<PERFORMNUD,DAD>
media: autoselect
status: active
utun0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1380
inet6 fe80::XXXX:a585:1912:fde8%utun0 prefixlen 64 scopeid 0xb
nd6 options=201<PERFORMNUD,DAD>
utun1: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 2000
inet6 fe80::XXXX:88f8:a44f:abd7%utun1 prefixlen 64 scopeid 0xc
nd6 options=201<PERFORMNUD,DAD>

I tried to ping as said at the beginning but it didn't give much (I search and found on Mac it should be ping -l...but it didn't work either):
ping -l 2001:4860:4860::8888
ping: invalid preload value: `2001:4860:4860::8888'

Then I followed your recommendation and had the same setup for the 1st screen (set up LAN interface to sue IPv6), change the range as per your example from 2 to 86 (mine was from 1000 to 2000), and on last screen, changed the Router Mode from "Assisted" to "Managed".

I saw you hided some info so did the same. Here is what I have in Status/Interface/WAN (by the way, what is this big "Release WAN" in red? should I do it?)

Screen Shot 2023-09-26 at 12.22.02 AM.png

Gertjan

@rheritier said in Despite months of config, still having connection issues:

Ipconfig /all (on Mac, it seems to be /sbins/ifconfig) and here is the result

Not really.
See ipconfig command for Mac and ... you'll get no answer.

I wanted to see this :

C:\Users\Gauche>ipconfig /all

Configuration IP de Windows

   Nom de l’hôte . . . . . . . . . . : Gauche2
   Suffixe DNS principal . . . . . . :
   Type de noeud. . . . . . . . . .  : Hybride
   Routage IP activé . . . . . . . . : Non
   Proxy WINS activé . . . . . . . . : Non
   Liste de recherche du suffixe DNS.: bhf.tld

Carte Ethernet Ethernet :

   Suffixe DNS propre à la connexion. . . : bhf.tld
   Description. . . . . . . . . . . . . . : Intel(R) Ethernet Connection (11) I219-LM
   Adresse physique . . . . . . . . . . . : A4-BB-6D-BA-16-A1
   DHCP activé. . . . . . . . . . . . . . : Oui
   Configuration automatique activée. . . : Oui
   Adresse IPv6. . . . . . . . . . . . . .: 2a01:cb19:907:dead::c7(préféré)
   Bail obtenu. . . . . . . . . . . . . . : dimanche 17 septembre 2023 12:09:05
   Bail expirant. . . . . . . . . . . . . : mardi 26 septembre 2023 18:53:29
   Adresse IPv6 de liaison locale. . . . .: fe80::daa9:bcf8:99cd:717e%11(préféré)
   Adresse IPv4. . . . . . . . . . . . . .: 192.168.1.6(préféré)
   Masque de sous-réseau. . . . . . . . . : 255.255.255.0
   Bail obtenu. . . . . . . . . . . . . . : dimanche 17 septembre 2023 12:09:03
   Bail expirant. . . . . . . . . . . . . : mercredi 27 septembre 2023 06:53:26
   Passerelle par défaut. . . . . . . . . : fe80::92ec:77ff:fe29:392c%11
                                       192.168.1.1
   Serveur DHCP . . . . . . . . . . . . . : 192.168.1.1
   IAID DHCPv6 . . . . . . . . . . . : 346340205
   DUID de client DHCPv6. . . . . . . . : 00-01-00-01-26-59-DF-8D-A4-BB-6D-BA-16-A1
   Serveurs DNS. . .  . . . . . . . . . . : 2a01:cb19:907:dead:beef:77ff:fe29:392c
                                       192.168.1.1
   NetBIOS sur Tcpip. . . . . . . . . . . : Activé
   Liste de recherche de suffixes DNS propres à la connexion :
                                       bhf.tld

This doesn't hardware aspect of the interface, but : It got an IPv4 using DHCP, who is the DHCP server (192.168.1.1 == pfSense), and the same info about IPv6.
Also : who is my DNS for this PC (pfSense).

@rheritier said in Despite months of config, still having connection issues:

ping -l 2001:4860:4860::8888

'-l' ? Try

ping6 2001:4860:4860::8888

Although a ping using ICMPv6 will only work if you obtained IPv6 by using DHCPv6 (client) or a static IPv6 assignment (don't forget the IPv6 gateway, don't forget the DNSv6)

@rheritier said in Despite months of config, still having connection issues:

by the way, what is this big "Release WAN" in red? should I do it?

On your WAN interface, you use DHCPv4 and/or DHCPv6 to obtain a IPv4 lease and / or IPv6 info.
Leases can be released

So that's what the button does. You rarely, if never, need to do that.
If you were editing the DHCP server settings of the upstream server, you would : validate your settings, and the release, and renew the IPs of your WAN to have tour pfSense reconnect again using the new lease info.
You could also remove the WAN cable for a short moment, and re insert it.

Btw : my pfSense LAN :

On the DHCPv6 LAN server page : check :

JonathanLee

Also if you enabled DHCP6 you need to set Squid to listen on IPV6 too as clients have IPv6 access

rheritier

@JonathanLee noted!
This is the only change to bring to do so, right?

Screen Shot 2023-09-26 at 10.33.21 AM.png